DCAA compliance: what it means for government contractors

A compliance lead at a 300-plus-worker contractor described the gap plainly: no one signs off on a time sheet before payroll runs. If a worker disputes their hours later, there’s no documented agreement to point to.

That’s a Department of Labor exposure. For contractors holding federal contracts, Defense Contract Audit Agency (DCAA) compliance raises the same risk under a stricter regulator, one that can withhold contract payments instead of just issuing a citation.

This guide covers what DCAA compliance actually requires, and where the popular claim that a product can “be” DCAA compliant doesn’t hold up.

For broader context on field timekeeping, see our guide to construction time and location tracking software.

What is DCAA compliance?

DCAA compliance is a contractor’s ability to show, on demand, that its timekeeping and accounting practices meet the standards DCAA checks during a federal audit: daily self-recorded time, correct cost coding, and a documented correction trail.

DCAA sits inside the Department of Defense. It audits contractor accounting systems and costs for the DoD and other federal agencies, and checks that billed amounts are allowable, allocable, and reasonable.

Staying compliant protects a contractor’s cash flow and its standing to keep bidding on federal work. A failed audit can mean withheld payments, disallowed costs, or in serious cases, a referral for further investigation.

DCAA itself doesn’t build software, certify it, or maintain an approved-vendor list. It audits the contractor’s accounting system, timekeeping practices, and internal controls, not the logo on the timesheet.

Why “DCAA-compliant software” isn’t a real certification

No DCAA compliance software carries an official government stamp, no matter what a landing page implies. That phrase describes a marketing claim, not a program that exists at DCAA.

A tool can be built for the controls DCAA looks at. It cannot be independently “DCAA compliant” on its own, because compliance also depends on written policies, crew training, and consistent practice across the whole accounting system, not one app.

The flow below traces that process step by step, from a worker’s clock-in to the accounting system DCAA actually reviews.

Who needs to worry about DCAA compliance

DCAA compliance mainly applies to contractors on cost-reimbursement, incentive-fee, or time-and-materials federal contracts, since those are billed based on actual costs or hours instead of a fixed price.

The rules mainly bind contractors on:

• Cost-reimbursement contracts, where the government pays actual allowable costs plus a fee
• Time-and-materials and labor-hour contracts, billed for actual hours worked rather than a fixed price
• Contracts with progress payments based on incurred costs

A firm-fixed-price contractor is paid a set amount regardless of hours, so DCAA’s scrutiny applies much more lightly, if at all.

A government contractor accounting system is evaluated separately, under its own dedicated business-systems clause; DCAA compliance requirements for timekeeping cover only two of its 18 criteria.

The rest, cost segregation, indirect rates, billing reconciliation, sits with a contractor’s accounting or ERP system, not any time-tracking app.

Types of DCAA audits

DCAA runs several distinct types of audits: preaward surveys, floor checks, incurred cost audits, and business system reviews, each examining a different part of a contractor’s process. 

Preparing for each protects DCAA audit compliance overall:

• Preaward surveys, which evaluate whether a contractor’s accounting system can support a cost-type contract before award
• Floor checks, unannounced site visits where an auditor interviews workers to confirm they’re on the clock and correctly coded
• Incurred cost audits, which review a full year of billed costs after the fact
• Business system reviews, which assess whether accounting, timekeeping, and billing together still meet DFARS criteria

DCAA audit compliance isn’t a single pass-or-fail moment. It’s several separate reviews spread across years, each looking at a different slice of the same records.

DCAA compliance checklist: what timekeeping controls require

Use this DCAA compliance checklist to see the ten DCAA compliance requirements an auditor checks during a system review.

Requirement	What it means	Source
Self-recorded time	Each worker records their own hours; supervisors or admins don’t enter time on someone else’s behalf as standard practice.	FAR daily-record rule
Daily entry	Hours are logged as work happens, not reconstructed at the end of the week or pay period.	Same FAR rule
Cost-objective coding	Every entry is coded to the contract, job, or cost objective the work supports.	DFARS (c)(9)
Work-authorization traceability	Direct hours can be traced back to an authorized job, task order, or work package.	DFARS (c)(9)
Worker certification	The worker certifies their own recorded hours are accurate.	DFARS (c)(9)
Separate supervisor approval	A supervisor approves the time card as a distinct step from the worker’s own certification.	DFARS (c)(9)
Total time accounting	All hours worked are recorded, including indirect, overhead, PTO, and idle time with a reason, even for exempt staff.	FAR 52.237-10
Correction audit trail	Every edit keeps the original value, the new value, who made the change, and why.	DFARS (c)(9)
Reconciliation to payroll and the GL	Hours tie back to payroll dollars and the job cost ledger.	DFARS (c)(10)
Three-year retention	Records are kept at least three years past final contract payment.	FAR 4.7; FAR 52.215-2

Get any one of these DCAA compliance timesheets wrong, especially the correction audit trail, and an otherwise solid timekeeping process can still fail a review.

A business system deficiency in timekeeping can trigger real financial consequences: a 5 percent withholding for one system, up to 10 percent if multiple business systems have material weaknesses.

Direct versus indirect labor is where DCAA compliance timesheets get confusing fastest. Hours must split correctly between project work and support activities like training.

This is also where DCAA compliance time tracking gets oversold. A tool can capture the split; it can’t decide which cost pool each activity belongs in.

How software supports DCAA timekeeping compliance

Time-tracking software can directly support several DCAA timekeeping requirements, though capabilities vary widely across labor tracking platforms. The accounting-system side always stays separate.

Most searches for DCAA compliance time tracking are really asking whether an app carries a stamp of approval. No app does, since no product delivers full DCAA timekeeping compliance on its own.

Workyard is built for the timekeeping side of this checklist, not the full accounting-system evaluation. Here’s how that maps to the specific criteria.

Requirement	How this is typically covered
Self-recorded time	Each worker clocks in on their own phone, with GPS location capture available.
Daily entry	Clock-ins and clock-outs are real-time events as work happens, not entered after the fact at period end.
Cost-objective coding	Job numbers and cost codes attach to every time entry.
Work-authorization traceability	Reports can show labor time tied to specific jobs and cost codes.
Worker certification and supervisor approval	Workers sign off on their own time cards, and a separate manager-level approval step follows, with an audit trail of who approved what and when.
Correction audit trail	Every edit is logged with the original entry, the new entry, who made the change, and a required reason.
Reconciliation to payroll and the GL	Field hours flow to payroll and accounting integrations; the reconciliation itself happens in the contractor’s payroll or ERP system.
Three-year retention	Data retention continues for the life of an active subscription.

The diagram below sums up that same split at a glance: what typically lives in field software on the left, and what stays with the accounting system on the right.

One item in the diagram above is worth calling out honestly: job-costed field hours are well covered, but indirect, overhead, shop, and idle-with-reason time depend on whether a contractor tracks those categories in the same system.

Reconciliation to the general ledger is outside a time-tracking tool’s scope by design. Field software supplies verified hours; the accounting system carries them into dollars and the ledger.

Vendors selling “DCAA compliance software” as a simple checkbox are selling something that doesn’t exist as a government program. What’s realistic is software built for the timekeeping requirements under DFARS (c)(9), paired with an accounting system that handles the other 16 criteria.

Two Workyard customers illustrate the timekeeping piece. At Green Wall Tech, a California drywall and plaster subcontractor, the CFO explained why worker sign-off mattered.

“Compliance has to be number one because the liability there can break your business,” the CFO said. Worker self-certification replaced a manual DocuSign process the company had relied on before.

At Earned Run, the director described the value of a documented audit trail for outside verification.

“We can present a comprehensive bill to our clients at the end of every 30 days with a complete audit trail,” the director said. “We can show our clients everything that happened, seven days a week. Before Workyard, we didn’t have that supporting evidence.”

Contractors already using GPS-based time tracking or systems like Sage Intacct should confirm with their advisor how field data reconciles into their setup.