Business Operations
DCAA Compliance for Small Defense Contractors
There is no such thing as DCAA-certified software. DCAA audits your entire accounting system — the software, the policies, the controls, and how employees actually behave. You can buy the most expensive GovCon ERP on the market and still fail because timesheets are filled out late.
Core Requirements (SF 1408)
Segregation of direct and indirect costs in the general ledger.
Identification and exclusion of FAR Part 31 unallowable costs from indirect pools.
Cost accumulation by contract, task order, and CLIN.
Logical, consistent indirect rate allocation methodology (Fringe, Overhead, G&A).
DCAA-compliant timekeeping: daily entry, total time accounting, charge codes, approval trail.
The Three Audits You'll See
Pre-Award Survey (SF 1408): can the system accumulate costs correctly? You're judged on design, not history.
Incurred Cost Submission audit: the annual reckoning. Actuals true up against provisional rates billed during the year.
The Floor Check: unannounced, focused on timekeeping. Employees who can't show current timesheets fail the entire firm.
Building It Without Going Broke
Two paths: QuickBooks plus a compliant timekeeping/expense layer with a GovCon-savvy controller, or a purpose-built entry-level ERP (Unanet, Deltek Costpoint Foundations, JAMIS).
Write the policies before you need them. Timekeeping, expense, unallowable cost, and indirect rate SOPs that match what the software actually does.
Train relentlessly. "I usually fill out my timesheet on Friday" is a failed floor check.
Outsource the complex stuff — month-end close, rate calcs, ICS prep — to a specialized GovCon firm. Keep bookkeeping in-house.
Managing the Auditor
Designate a single audit liaison — usually the Controller or CFO. Be present for every employee interview.
When findings come, respond in writing within the timeline. Acknowledge, explain root cause, describe corrective action. Save your battles for findings you can actually win.
Want help putting this into practice?
Desra Secure operates DCAA-compliant accounting and ICS preparation for small defense contractors.
This guide is provided for general informational purposes only and does not constitute legal, accounting, or compliance advice. Specific obligations depend on your contracts and your environment.