DCAA Audit Process: Types, What to Expect, and How to Prepare

Government contractors know DCAA exists. What most do not know, until they receive the entrance conference letter, is exactly what a DCAA audit looks like, how the agency decides who to audit, or what rights they have once the process starts. The Defense Contract Audit Agency (DCAA) is the principal audit arm of the Department of Defense, responsible for evaluating costs charged by contractors under flexibly priced contracts (cost-reimbursement, time-and-materials, and incentive-type awards). DCAA does not make final decisions on cost allowability. That authority belongs to the contracting officer. But DCAA’s audit findings carry significant weight, and a bad audit report can result in questioned costs running into hundreds of thousands of dollars, payment withholdings, rate adjustments that ripple across every contract in the contractor’s portfolio, and in the worst cases, referrals to the Department of Justice for False Claims Act investigation.

This guide walks through the types of audits DCAA performs, how the agency selects contractors for audit, what happens during each phase of the audit, what contractors can (and cannot) do during the process, and how to prepare before an audit is announced.

What types of audits does DCAA perform?

DCAA’s audit portfolio covers the full lifecycle of a government contract, from the proposal stage through performance to final closeout. Each type of audit serves a different purpose and uses different audit procedures, but they all come back to the same core question: are the costs the contractor is charging (or proposing to charge) allowable, allocable, and reasonable under FAR Part 31?

Pre-award accounting system survey. Before a contracting officer awards a cost-type contract, DCAA typically evaluates whether the prospective contractor’s accounting system can track costs the way the government requires. This survey uses the SF 1408 questionnaire and covers the criteria in DFARS 252.242-7006: segregation of direct and indirect costs, cost accumulation by contract, unallowable cost exclusion, timekeeping, and interim billing capability. A contractor pursuing its first cost-reimbursement award will almost always face this survey, and an inadequacy finding can block the award entirely. For a deeper breakdown of the adequacy criteria, see the guide on DCAA compliant accounting system requirements.

Incurred cost audit. This is the audit most contractors think of when they hear “DCAA audit.” After each fiscal year, contractors with cost-type contracts submit an incurred cost submission (commonly prepared using the DCAA ICE model) that reports all costs incurred during the year, broken down by contract, indirect cost pool, and allocation base. DCAA then audits that submission by testing a sample of actual costs against the allowability rules in FAR 31.205. The auditor pulls transactions, traces them from the general ledger to source documents (invoices, receipts, contracts, timesheets), and evaluates whether each tested cost is allowable, allocable to the contract or pool it was charged to, and reasonable in amount. The output is a list of questioned costs and recommended indirect rate adjustments.

Forward pricing audit. When a contractor submits a proposal for a new contract or a modification to an existing one, and the proposed value is above a certain threshold, the contracting officer may request DCAA to audit the proposed rates and costs. The forward pricing audit evaluates whether the proposed indirect rates (fringe, overhead, G&A) and the proposed direct costs (labor rates, material estimates, travel, subcontractor costs) are supportable and reasonable. The auditor compares proposed rates to historical actuals, evaluates the basis for any projected increases, and tests the proposed direct costs against market data or historical spending. This audit often happens in parallel with the contract negotiation process.

Labor floor check. Floor checks are unannounced visits to a contractor’s work site. A DCAA auditor shows up without prior notice, identifies employees present, and asks them what they are currently working on. The auditor then compares each employee’s answer to the charge number recorded on that employee’s timesheet for that day. The purpose is to detect labor mischarging, where an employee’s time is recorded against one contract but the employee is actually performing work on a different contract, a proposal, or an indirect activity. Floor checks can also be conducted for remote workforces, where DCAA reviews communication logs, project management tools, or conducts virtual interviews.

CAS compliance audit. Contractors that are subject to the Cost Accounting Standards (CAS), either full CAS coverage (for contracts above the full-coverage threshold) or modified CAS coverage (for most CAS-covered contracts), must follow the standards governing cost measurement, assignment, and allocation. DCAA audits CAS compliance by reviewing the contractor’s Disclosure Statement (CASB DS-1), comparing it to actual practices, and testing whether cost accounting changes have been properly disclosed and whether the government has been made whole for any increased costs resulting from a change. A CAS noncompliance finding can trigger a requirement to adjust costs across all affected contracts, not just the contract where the noncompliance was found.

Special-purpose audits. DCAA also performs audits in specific circumstances outside the regular cycle. These include audits of termination settlement proposals (when a contract is terminated for convenience and the contractor submits a claim for costs incurred and profit), equitable adjustment claims (when the contractor seeks additional compensation due to a government-caused change or delay), and defective pricing reviews under the Truth in Negotiations Act (TINA), where DCAA evaluates whether the contractor submitted accurate, complete, and current cost or pricing data during negotiations. Defective pricing findings can lead to price reductions equal to the amount by which the contract price was overstated.

How does DCAA decide which contractors to audit?

DCAA does not audit every contractor every year. The agency uses a risk-based audit selection model that weighs several factors to determine where audit resources will generate the most value for the government.

Dollar value of flexibly priced contracts is the primary driver. A contractor with $50 million in annual cost-reimbursement billings will draw more audit attention than one with $2 million, simply because the potential dollar impact of any findings is larger. DCAA concentrates its resources on the contractors where questioned costs are most likely to be material.

Prior audit history matters. A contractor with a clean audit history, well-documented systems, and a track record of timely incurred cost submissions may be audited less frequently than one with recurring findings, late submissions, or system deficiencies from prior audits. Conversely, a contractor whose last incurred cost audit produced significant questioned costs or a CAS noncompliance finding is likely to see DCAA return sooner.

Contracting officer referrals trigger audits outside the normal cycle. If a contracting officer has concerns about a contractor’s billing practices, timekeeping, or cost charging (perhaps based on questions from the program office, whistleblower complaints, or anomalies in invoices), the CO can request DCAA to perform a specific audit. These referral-driven audits can be narrowly scoped or can expand into broader reviews depending on what the auditor finds.

The audit backlog is a practical reality that every contractor should understand. DCAA has historically carried a significant backlog of incurred cost audits. Some contractors wait five years, and in some cases closer to ten, between the fiscal year they submit and the fiscal year DCAA actually audits that submission. The backlog does not relieve the contractor of the obligation to submit on time (six months after the fiscal year end) or to maintain records that support the submission. A contractor audited in 2026 for its fiscal year 2020 costs still needs to produce every invoice, receipt, timesheet, and allocation schedule from 2020. The audit backlog is also why maintaining good records and a consistent filing system is not optional. If your records cannot survive a five-year gap between submission and audit, you have a problem that no amount of preparation in the weeks before the entrance conference can fix.

What happens during an incurred cost audit?

The incurred cost audit follows a structured process that moves from announcement through fieldwork to final resolution.

Entrance conference. DCAA notifies the contractor that it will be auditing one or more fiscal years. The entrance conference (which may be a formal meeting, a phone call, or a letter with a document request list) sets the scope, introduces the audit team, explains the audit objectives, and establishes the timeline for document production. The auditor will typically provide an initial document request list at or shortly after the entrance conference.

Document requests and fieldwork. The document request list is extensive. It typically includes the incurred cost submission itself, the general ledger detail for the audit period, trial balances, subsidiary ledgers for each indirect cost pool, payroll records, timesheets, invoices for sampled transactions, travel records, subcontractor agreements and invoices, executive compensation records (salary, bonus, benefits, stock compensation), the contractor’s policies and procedures manual, insurance certificates, lease agreements, depreciation schedules, and the contractor’s reconciliation of the incurred cost submission to the general ledger. The auditor will also request the CASB Disclosure Statement if the contractor is CAS-covered.

During fieldwork, the auditor tests transactions. The approach is sample-based: the auditor selects a statistical or judgmental sample of direct costs and indirect costs, pulls the source documents, and evaluates each cost against FAR 31.205 allowability criteria. The auditor also recalculates the indirect rates by independently computing each pool total and each allocation base, comparing the result to the rates used in the contractor’s billings. If the audited rates differ from the billed rates, the difference becomes a rate adjustment.

Interviews. DCAA auditors interview accounting staff, project managers, and sometimes executives. The interviews cover how costs are classified, how timesheets are prepared and approved, how unallowable costs are identified and excluded, and how indirect rates are computed. The auditor is comparing what the contractor’s written policies say to what the staff actually does. A disconnect between policy and practice is a finding.

Draft audit report. After completing fieldwork, DCAA issues a draft audit report to the contractor. The report identifies questioned costs (costs the auditor recommends disallowing), recommended rate adjustments, and any system deficiencies or noncompliances found during the audit. Each finding includes the auditor’s basis, the applicable FAR or CAS citation, and the dollar impact.

Contractor response. The contractor has the right to respond to the draft audit report. This is a critical step. The response should address each finding with specific evidence: source documents, policy citations, transaction details, or legal arguments for why the cost is allowable. A well-prepared response can result in DCAA withdrawing or reducing findings before the final report issues. A weak or generic response (“we disagree”) accomplishes nothing.

Final audit report. After considering the contractor’s response, DCAA issues the final audit report to the contracting officer. This report is DCAA’s recommendation, not a final determination. The contracting officer (typically the administrative contracting officer, or ACO) reviews the report and uses it as the basis for negotiating final indirect rates and settling questioned costs with the contractor.

Rate negotiation and settlement. The contractor negotiates directly with the contracting officer, not with DCAA. The CO can accept DCAA’s recommendations in full, reject some findings, or negotiate a settlement that splits the difference on certain costs. Once the CO and the contractor agree on final rates, those rates are memorialized in a rate agreement, and the contractor adjusts its billings across all affected contracts. Overpayments are refunded to the government; underpayments result in additional billing.

What rights does a contractor have during a DCAA audit?

Contractors are not passive subjects of the audit process. Federal procurement regulations and DCAA’s own audit guidance establish several contractor rights.

The contractor has the right to receive the audit report. DCAA must provide a copy of both the draft and final audit reports to the contractor. The contractor is not left guessing about the findings.

The contractor has the right to respond to findings before the report is finalized. The draft report response period is the contractor’s opportunity to present evidence, arguments, and documentation that supports the allowability of questioned costs or challenges the auditor’s methodology. As noted above, this response can change the outcome.

The contractor has the right to negotiate with the contracting officer. Because DCAA’s findings are advisory (not binding), the contractor’s real negotiation is with the CO. If the contractor disagrees with the CO’s final determination on cost allowability or rate adjustments, the contractor can pursue a formal dispute.

The contractor has the right to appeal. If the contracting officer issues a final decision that the contractor disagrees with, the contractor can appeal to the Armed Services Board of Contract Appeals (ASBCA) or file suit in the United States Court of Federal Claims. These are the formal adjudicative bodies that resolve government contract disputes. The appeals process can be lengthy and expensive, but it provides a check on contracting officer determinations that are unsupported by the facts or misapply the FAR cost principles.

The contractor also has the right to limit DCAA’s access to records that are not relevant to the audit scope. DCAA’s access rights under FAR 52.215-2 are broad, but they are not unlimited. A contractor can (and should) push back on requests for records that fall outside the stated audit scope, particularly requests for privileged communications or commercially sensitive information unrelated to government contracts.

What are the most common DCAA audit findings?

Certain findings appear repeatedly across DCAA incurred cost audits, regardless of contractor size or industry. Understanding these patterns allows a contractor to focus its pre-audit preparation where it will have the most impact.

Unallowable costs charged to contracts or included in indirect cost pools. FAR 31.205 lists over 50 categories of costs and specifies which are allowable, which are unallowable, and which are allowable with limitations. The most frequently questioned categories include entertainment (always unallowable), alcoholic beverages (always unallowable), lobbying and political activity (always unallowable), contributions and donations (unallowable), bad debts (unallowable), fines and penalties (unallowable), advertising other than for recruitment or required contract notices (unallowable), and interest expense (generally unallowable). A contractor that does not have a reliable process for identifying and excluding these costs from billings will face questioned costs in virtually every incurred cost audit.

Excessive executive compensation. FAR 31.205-6(p) caps the amount of senior executive compensation that can be charged to government contracts. DCAA compares actual compensation (salary plus bonus plus deferred compensation plus stock compensation) for each of the contractor’s five most highly compensated executives to the benchmark cap, which is published annually and based on a Bureau of Labor Statistics survey. Compensation above the cap is questioned. This finding is especially common among small and mid-size contractors where the owner also functions as the CEO and sets their own compensation.

Labor mischarging and timekeeping deficiencies. Labor is typically the largest cost element on a services contract, and timekeeping is one of DCAA’s core focus areas. Common findings include employees who do not record time daily, timesheets without supervisory approval, undocumented corrections to timesheets, failure to account for total time (the employee worked 45 hours but only recorded 40), and floor check discrepancies where employees were observed performing work different from what their timesheets reflected.

Inconsistent cost accounting treatment. If a contractor charges a particular type of cost as direct on some contracts and indirect on others, or changes its allocation methodology without proper disclosure, DCAA will flag the inconsistency. Consistency is a core CAS principle, and even contractors not subject to full CAS coverage are expected to treat like costs in a like manner across contracts and accounting periods.

Unsupported costs. A cost may be perfectly allowable in theory, but if the contractor cannot produce the invoice, receipt, or other documentation to support it, DCAA will question it. The documentation requirement is especially rigorous for travel (receipts for airfare, hotel, ground transportation, and meals above a threshold), subcontractor costs (the subcontract agreement plus invoices plus evidence of deliverables), and consultant payments.

Indirect rate computation errors. DCAA recalculates every indirect rate. If the contractor’s pool includes a cost that should be in a different pool, or the allocation base excludes an element it should include (or vice versa), the recalculated rate will differ from the billed rate. Rate errors that favor the contractor result in a recommended rate reduction and an overpayment that must be refunded.

How should a contractor prepare for a DCAA audit?

The best audit preparation is not a last-minute scramble when the entrance conference letter arrives. It is a year-round discipline of maintaining clean records, enforcing policies, and running periodic self-assessments. That said, once an audit is announced, there are specific steps that can materially improve the outcome.

Run a self-assessment against FAR 31.2. Pull the general ledger for the audit period and review every account for costs that might be unallowable. Entertainment, alcohol, personal expenses, charitable contributions, lobbying, fines, penalties, and interest should be identified and confirmed that they were excluded from all indirect cost pools that feed into government billings. If any slipped through, the contractor should calculate the impact and consider making a voluntary disclosure to the contracting officer before DCAA finds the error. A voluntary disclosure does not eliminate the questioned cost, but it demonstrates good faith and can reduce the risk of a fraud referral.

Reconcile the books to the incurred cost submission. The incurred cost submission is the document DCAA will audit against. If the submission does not reconcile to the general ledger and trial balance, the auditor will start the engagement skeptical and will spend more time testing. Before the audit begins, the contractor should verify that every number in the submission ties to the books, that the indirect cost pools foot to the general ledger, and that the allocation bases are correctly computed. The guide on incurred cost submissions covers the reconciliation process in detail.

Scrub unallowable costs. This is distinct from the FAR 31.2 self-assessment. The scrub is a transaction-level review of the accounts that carry the highest risk of unallowable cost contamination: meals and entertainment, travel, professional development, dues and subscriptions, insurance, and executive compensation. Pull the detail, review each line, and confirm that every cost in those accounts is correctly classified.

Review the timekeeping system. Pull a sample of timesheets from the audit period and check for the basics: daily recording, supervisory approval, documented corrections, total time accounting. If there are gaps (employees who submitted weekly instead of daily, timesheets without approvals, corrections without explanations), identify them before the auditor does and prepare an explanation and evidence of corrective action taken.

Update the policies and procedures manual. DCAA will review the manual and compare it to actual practice. If the manual describes a process the contractor has since changed, or if it omits a process the contractor has adopted, the disconnect is a finding. The manual should accurately reflect current practice as of the audit period. If practices changed after the audit period, the contractor should be prepared to explain the timeline.

Organize source documents. For the audit period, ensure that the contractor can produce, on request, invoices, receipts, contracts, subcontract agreements, payroll records, timesheets, travel authorizations, purchase orders, and board minutes (for compensation decisions). Organize them by account, vendor, or contract so retrieval is fast. A contractor that takes weeks to respond to document requests frustrates the auditor and extends the audit timeline unnecessarily.

What is the relationship between DCAA and the contracting officer?

This is one of the most misunderstood aspects of the DCAA audit process, and getting it wrong can cost a contractor money.

DCAA audits and recommends. The contracting officer decides. That is the division of authority, and it is established by regulation, not by informal practice. DCAA’s audit reports are advisory opinions. They carry significant weight because the CO relies on DCAA’s technical expertise in cost accounting, but they are not binding determinations. The contracting officer (specifically, the administrative contracting officer or ACO for post-award matters) is the government official with the authority to determine cost allowability, negotiate final indirect rates, and settle questioned costs.

This distinction matters because the contractor’s negotiation is with the CO, not with DCAA. If a contractor disagrees with a DCAA finding, the appropriate response is to present evidence and arguments to the contracting officer, not to argue with the DCAA auditor (though the draft report response, which goes to DCAA, is also important). The CO can, and sometimes does, accept a cost that DCAA questioned, or reject a cost that DCAA did not question. The CO’s determination is what controls.

In practice, many contracting officers accept DCAA’s recommendations without significant independent analysis, particularly when the contractor does not present a strong counter-argument. This is why the contractor’s response to the draft audit report and the subsequent negotiation with the CO are both critical. A contractor that treats the DCAA audit report as a final determination and simply accepts the findings is leaving money on the table. A contractor that prepares a detailed, evidence-based response to each finding and engages the CO in a substantive negotiation will almost always achieve a better outcome.

What penalties can result from DCAA audit findings?

The consequences of DCAA findings range from routine cost adjustments to criminal prosecution, depending on the nature and severity of the issues.

Questioned costs and rate adjustments. The most common outcome is that DCAA questions certain costs, the contracting officer determines which costs are allowable, and the contractor’s indirect rates are adjusted to reflect the disallowances. The contractor refunds the overpayment (the difference between the billed rates and the audited rates, multiplied across all affected contracts). For a contractor with a large portfolio, even a small rate adjustment can result in a substantial refund obligation.

Payment withholdings. If DCAA finds the contractor’s accounting system inadequate, the contracting officer can withhold up to 10% of interim payments under DFARS 252.242-7006 until the deficiencies are corrected. If the contractor fails to submit the incurred cost submission on time, the CO can also withhold payments. These withholdings directly affect cash flow and can create serious financial strain, particularly for small contractors operating on thin margins.

False Claims Act exposure. If DCAA finds evidence that the contractor knowingly submitted false claims for payment (charging costs the contractor knew were unallowable, fabricating timesheets, misrepresenting costs in proposals), DCAA can refer the matter to the Department of Justice for investigation under the False Claims Act (31 U.S.C. 3729-3733). The False Claims Act imposes treble damages (three times the government’s actual damages) plus per-claim penalties that are adjusted for inflation and currently exceed $13,000 per false claim. A single year of billings that include knowingly unallowable costs can generate False Claims Act exposure in the millions. The Act also has a qui tam (whistleblower) provision that allows employees or former employees to file suit on behalf of the government and receive a share of the recovery.

The penalty structure under the False Claims Act has parallels in the tax context. Just as the IRS accuracy-related penalty tests whether a taxpayer acted with reasonable cause and in good faith, the False Claims Act tests whether the contractor acted “knowingly,” which includes actual knowledge, deliberate ignorance, and reckless disregard of the truth. A contractor that has no system for identifying unallowable costs is not “innocent.” It is recklessly disregarding a known obligation.

Suspension and debarment. In the most severe cases, a contractor can be suspended (temporarily excluded from receiving new government contracts) or debarred (excluded for a specified period, typically three years). Suspension and debarment are reserved for cases involving fraud, criminal conduct, or a pattern of serious contract performance failures, but a DCAA referral can initiate the process. For a contractor whose business depends on government work, debarment is effectively a death sentence.

How does a floor check work?

Floor checks deserve their own discussion because they are unlike any other audit procedure DCAA performs, and because the consequences of a bad floor check can be disproportionate to the actual error.

A floor check is an unannounced visit. DCAA does not call ahead. An auditor (or a team of auditors, for a large facility) arrives at the contractor’s work site during normal business hours. The auditor identifies employees working in the facility, asks each employee what they are currently working on, and records the responses. The auditor may also ask employees to show what is on their screen, to identify the contract or task they are performing, and to name the charge number they are recording their time against for that day.

After the visit, DCAA compares the auditor’s observations to the timesheets submitted for that day. If an employee told the auditor they were working on a proposal (which is a B&P, or bid-and-proposal, indirect cost) but their timesheet for that day shows eight hours charged to Contract X, the auditor has a labor mischarging finding. If the finding is isolated (one employee, one day, an apparent error rather than a pattern), the result is typically a questioned cost and a recommendation for improved timekeeping controls. If the finding suggests a pattern (multiple employees, multiple instances, or evidence that employees were instructed to charge time to a contract they were not working on), the matter can escalate to a fraud referral.

Floor checks are one of the reasons daily timekeeping matters. If employees record their time weekly or at the end of a pay period, they are reconstructing from memory rather than recording in real time. A floor check that catches a discrepancy on a day when the employee recorded time from memory three days later is a much stronger finding than one where the employee recorded time daily and simply made a same-day error.

Hypothetical: DCAA floor check uncovers labor mischarging

Consider a hypothetical IT services contractor performing work on two government contracts and also preparing a proposal for a new contract. At 10:30 AM on a Tuesday, a DCAA auditor arrives unannounced at the contractor’s office. The auditor identifies 20 employees present and interviews five of them about their current work assignments.

Three of the five employees confirm they are working on the contracts reflected on their timesheets for that day. Two employees, however, tell the auditor they are currently working on the proposal for the new contract, a B&P activity that should be charged to the B&P indirect cost pool. When the auditor later reviews those two employees’ timesheets for that day, both show eight hours charged to Contract X.

The finding is a labor mischarging discrepancy for two employees on one day. DCAA reports the finding to the contracting officer, and the contractor is required to prepare a corrective action response. The contractor investigates and determines that the two employees had been pulled into the proposal effort that morning by a project manager who did not realize they needed to change their charge numbers. The employees did not update their timesheets to reflect the B&P work.

The corrective action includes reclassifying the misrecorded hours from Contract X to B&P, retraining all employees on the requirement to record time contemporaneously and to change charge numbers whenever they shift between activities, updating the timekeeping policy to require supervisor notification when employees are temporarily reassigned, and implementing a reminder in the timekeeping system that prompts employees to confirm their charge number at midday.

The dollar amount of the questioned cost in this hypothetical is relatively small (a few hours of labor for two employees on one day), but the reputational impact and the administrative cost of the corrective action are significant. A finding of labor mischarging, even an inadvertent one, goes into the contractor’s audit history and increases the likelihood of future floor checks and closer scrutiny of timekeeping in the next incurred cost audit.

What happens during a forward pricing audit?

When a contractor submits a proposal for a new cost-type contract, contract modification, or option-year exercise above the threshold for certified cost or pricing data (currently $2 million under 10 U.S.C. 3453), the contracting officer may request DCAA to audit the proposed costs and rates. The forward pricing audit evaluates whether the contractor’s proposed prices are fair and reasonable, based on the cost or pricing data submitted.

The auditor examines the proposed direct costs (labor categories, labor rates, hours, materials, travel, subcontractors, other direct costs) and the proposed indirect rates (fringe, overhead, G&A). For direct labor, the auditor compares proposed labor rates to actual payroll data, proposed escalation factors to historical trends or published indices, and proposed hours to historical performance on similar contracts or to the basis of estimate. For indirect rates, the auditor compares proposed rates to the most recently audited actual rates, evaluates the contractor’s projections for changes in pool costs or base costs, and tests the reasonableness of assumptions.

If the forward pricing audit identifies proposed costs that are unsupported, overstated, or based on unreasonable assumptions, DCAA recommends reductions. The contracting officer uses those recommendations in the contract negotiation. A contractor whose proposed rates are significantly higher than its audited actual rates will face difficult questions during negotiation.

Forward pricing audits are also where DCAA checks for defective pricing. If the contractor is required to submit certified cost or pricing data under TINA and the proposal contains data that is not accurate, complete, and current as of the date of agreement on price, the government can seek a price adjustment after award. This is why accuracy in the proposal is critical: overstating rates to create a cushion is not “conservative estimating.” It is a potential defective pricing issue.

What is a CAS compliance audit?

The Cost Accounting Standards (CAS), administered by the CAS Board, govern how contractors measure, assign, and allocate costs to government contracts. Contractors with CAS-covered contracts (above the CAS coverage threshold, currently $7.5 million for modified coverage and approximately $50 million in net CAS-covered awards for full coverage) must follow the applicable standards and disclose their cost accounting practices on the CASB Disclosure Statement (DS-1).

DCAA audits CAS compliance by comparing the contractor’s disclosed practices (what the DS-1 says) to its actual practices (what the books and records show). If the contractor has changed a cost accounting practice without properly disclosing the change and without calculating the cost impact on existing contracts, DCAA will issue a CAS noncompliance finding. The consequences of a CAS noncompliance are broader than a typical audit finding, because CAS adjustments can apply across all contracts affected by the noncompliance, not just the contract being audited.

Common CAS issues include changes to indirect rate structures (adding or eliminating a pool, changing an allocation base) without filing an amended DS-1, inconsistent treatment of the same type of cost across contracts (direct on some, indirect on others, without a documented basis), and failure to follow the disclosed practice for a specific cost element (the DS-1 says travel is a direct cost, but some travel is actually charged to the overhead pool).

Hypothetical: first incurred cost audit, three-year lag

Consider a hypothetical engineering contractor that received its first cost-reimbursement contract in fiscal year 2023. The contractor submitted its incurred cost submission for FY 2023 on time, in June 2024. Due to the DCAA audit backlog, the contractor does not receive an entrance conference letter until early 2026, nearly three years after the fiscal year ended.

The document request list arrives and covers every major account: the general ledger, trial balance, payroll registers, all timesheets for FY 2023, travel expense reports with receipts, subcontractor invoices, the indirect rate computation workpapers, executive compensation records, the policies and procedures manual as it existed in FY 2023, and the reconciliation of the incurred cost submission to the general ledger.

During fieldwork, the auditor selects a sample of 80 transactions across direct costs, fringe, overhead, and G&A. The audit produces findings totaling $45,000 in questioned costs across three categories.

First, $12,000 in entertainment costs (client dinners, event tickets, holiday party) were included in the G&A pool. Entertainment is unallowable under FAR 31.205-14 regardless of business purpose. The contractor had coded these expenses to a “business development meals” account within G&A and had not flagged them as unallowable.

Second, $18,000 in the owner’s bonus exceeded the FAR 31.205-6(p) compensation cap. The contractor’s owner served as CEO and set their own compensation. The total compensation (salary plus bonus) exceeded the benchmark cap by $18,000. The excess is unallowable.

Third, $15,000 in travel costs lacked adequate documentation. The expenses were recorded in the books, but the contractor could not locate the original receipts for airfare and hotel charges on six trips. Without receipts, DCAA could not verify the amounts or confirm that the travel was for contract purposes. The costs were questioned as unsupported.

The contractor responds to the draft audit report. On the entertainment costs, the contractor concedes the finding and agrees to reclassify the costs as unallowable. On the compensation cap, the contractor provides the BLS survey data and argues that the benchmark should be applied differently, but the auditor’s calculation is correct under DCAA’s methodology, so the finding stands. On the travel costs, the contractor locates receipts for three of the six trips (producing them from the travel agency’s records and credit card statements), and DCAA withdraws $8,000 of the $15,000 finding. The remaining $7,000 stays as questioned costs.

The final audit report goes to the contracting officer with $37,000 in questioned costs (down from $45,000 after the contractor’s response). The contractor negotiates with the CO, who accepts the findings. The contractor’s FY 2023 G&A rate is adjusted downward, and the contractor refunds the resulting overpayment across all cost-type contracts active in FY 2023.

The lessons from this hypothetical apply broadly. The entertainment costs were avoidable with a proper unallowable cost identification system. The compensation cap issue was knowable in advance (the benchmark is published annually). The missing travel receipts were a record-retention failure that cost the contractor $7,000 in costs that may well have been legitimate. And the three-year lag between the fiscal year and the audit meant the contractor had to dig through old records under time pressure, a process that would have been far easier if the records had been organized and indexed at the time of the incurred cost submission.

How long does a DCAA audit take?

There is no fixed timeline. A pre-award survey for a small contractor with clean records might take four to six weeks from entrance conference to report. An incurred cost audit for a large contractor with multiple contracts, complex indirect rate structures, and a high volume of transactions can take six months to a year or longer.

The variables that affect the timeline include the complexity of the contractor’s cost structure, the volume of transactions, the responsiveness of the contractor to document requests (slow responses extend the audit significantly), the number of findings and the complexity of the contractor’s responses, the auditor’s workload and DCAA’s internal review process, and whether the audit uncovers issues that require expanding the scope.

Contractors can influence the timeline by being responsive to document requests, organized in their record-keeping, and proactive in addressing questions. An entrance conference that is followed by a prompt, complete response to the initial document request sets a tone of cooperation and competence. A contractor that takes six weeks to produce basic records signals to the auditor that the accounting function has problems, which may lead to expanded testing.

What should contractors know about the audit backlog?

DCAA has publicly acknowledged a significant backlog of incurred cost audits. The backlog means that many contractors operate for years with provisional billing rates that have not been audited. This creates several risks.

The contractor may be overbilling or underbilling for years without knowing it. If the audited rates are lower than the billed rates, the contractor owes a refund that may have accumulated over multiple fiscal years. If the audited rates are higher, the contractor is owed additional payment, but the cash flow impact of underbilling in the interim can be significant.

Records degrade over time. Receipts fade, employees leave (taking institutional knowledge with them), and accounting systems are migrated or upgraded, sometimes losing historical data in the process. A contractor that is diligent about preserving audit-period records in a durable, accessible format will be in a far better position when the audit finally arrives.

The statute of limitations for the government to recover overpayments generally runs from the date of final determination, not from the fiscal year. This means the audit backlog does not protect the contractor from questioned costs. A cost incurred in 2020, questioned in 2026, and determined unallowable in 2027 is still recoverable.

DCAA has made efforts to reduce the backlog through risk-based prioritization, the use of low-risk incurred cost audit procedures (a streamlined approach for contractors with clean histories and small dollar values), and the threshold-based decision not to audit certain low-risk submissions at all. But for contractors above the materiality threshold with flexibly priced contracts, the audit is coming. The question is when, not whether.

How do I respond to a DCAA audit finding I disagree with?

Start with the draft audit report response. DCAA provides the contractor an opportunity to respond to the draft report before it is finalized. The response should be specific, factual, and supported by documentation. For each finding, the contractor should identify the specific FAR or CAS provision the auditor cited, present the facts and evidence that support the contractor’s position, explain why the cost is allowable (or allocable, or reasonable) under the cited provision, and attach supporting documents (invoices, contracts, policy excerpts, board resolutions, compensation surveys, or legal opinions).

If DCAA does not withdraw the finding after the contractor’s response, the finding goes into the final audit report. The contractor then negotiates with the contracting officer. The CO’s determination is what controls, and the CO has authority to reach a different conclusion than DCAA. If the CO issues a final decision the contractor disagrees with, the contractor can file a claim under the Contract Disputes Act and appeal to the ASBCA or the Court of Federal Claims.

The key at every stage is evidence. Assertions without documentation carry no weight. A contractor that says “this cost is allowable” without producing the invoice, the contract provision authorizing the cost, and the accounting records showing proper classification will lose the argument regardless of whether the cost is actually allowable.

Can DCAA access all of a contractor’s records?

DCAA’s access rights are established by FAR 52.215-2, Audit and Records, which is incorporated into most negotiated contracts. The clause gives the contracting officer and authorized representatives (including DCAA) the right to examine and audit the contractor’s books, records, documents, and other evidence sufficient to reflect properly all costs claimed to have been incurred or anticipated to be incurred. The right extends to records of subcontractors at any tier.

The access right is broad but not unlimited. It covers records related to costs charged or proposed to be charged to government contracts. It does not give DCAA blanket access to every record the contractor possesses. Records relating solely to commercial (non-government) work, attorney-client privileged communications, and proprietary data unrelated to government contract costs are generally outside the scope of the access right, though disputes over scope can arise and may need to be resolved through the contracting officer.

A contractor should cooperate fully with legitimate document requests but should also review each request to ensure it falls within the audit scope. If a request is overbroad (for example, requesting all records for the entire company when the audit covers a single contract), the contractor can discuss the scope with the auditor and, if necessary, escalate through the contracting officer.

Refusing to provide records that are within scope is counterproductive. DCAA can report the access denial to the contracting officer, who can suspend payments, issue an adverse determination on cost allowability (treating the unsupported costs as unallowable), or take other adverse action. The better approach is to provide what is within scope, push back on what is not, and document the entire process.

What is the difference between a questioned cost and a sustained finding?

A questioned cost is DCAA’s recommendation that a cost be disallowed. It appears in the audit report as a finding, with the FAR or CAS basis and the dollar amount. A questioned cost is not a final determination. It is the auditor’s opinion, delivered to the contracting officer for consideration.

A sustained finding is a questioned cost that the contracting officer ultimately determines is unallowable after considering the contractor’s response and conducting any additional analysis. Not all questioned costs are sustained. Contractors that provide strong responses to draft audit findings, and that engage the CO in substantive negotiation, can reduce the sustained rate significantly.

The distinction matters for financial planning. A contractor that sees $100,000 in questioned costs in a draft audit report should not assume it will pay $100,000. The final number depends on the strength of the contractor’s response, the quality of the supporting evidence, and the contracting officer’s independent judgment.

This guide is general information, not tax advice for your specific situation. Which points apply, and how, depends on your facts.