If your company is moving into federal contracting, the Defense Contract Audit Agency (DCAA) may eventually become a regular part of your operations. For some contractors, that day never arrives. For others, it shows up faster than expected. This article covers what triggers a DCAA audit, the main audit types, how long they take, what happens when findings go against you, and how often these audits actually happen.
Which contracts put you on DCAA's radar
DCAA audits track the way the government pays. The contracts that trigger audit activity share one feature: the government is paying for your actual costs, not a fixed price for a defined deliverable. That gives DCAA something to verify.
- Cost-reimbursement contracts are squarely in DCAA's territory. The government reimburses your actual allowable costs, and DCAA verifies which costs qualify.
- Time-and-materials and labor-hour contracts are also subject to ongoing audit activity. You bill hours and materials, and DCAA tests whether the hours reflect actual work.
- Firm-fixed-price contracts generally are not. Under fixed-price work, the government pays a set price for a defined deliverable. Your cost structure is your own concern.
The practical implication: a contractor doing only firm-fixed-price work may go years without DCAA contact. The day that same contractor pursues a cost-reimbursement opportunity, the picture changes entirely.
The main audit types
DCAA performs several distinct reviews at different points in the contract lifecycle:
- Pre-award accounting system audit (SF 1408). Tests whether your accounting system is designed to handle cost-type work. Performed before contract award.
- Incurred cost audit. Reviews actual costs claimed against cost-reimbursement contracts. Performed annually, well after the costs were incurred.
- Floor check. An unannounced visit to verify timekeeping practices in real time during contract performance.
- Business system audit. A periodic review of contractor business systems — accounting, estimating, purchasing, and others.
- Forward pricing, CAS, and TINA audits. Reviews tied to proposed pricing and specific compliance areas. Most small contractors do not encounter these.
For a small contractor entering cost-type work for the first time, the SF 1408 is usually the first encounter. Floor checks and incurred cost audits come during and after performance.
The pre-award audit (SF 1408)
The pre-award audit is exactly what it sounds like: a review the government performs before deciding whether to award you a cost-reimbursement contract. The mechanism is Standard Form 1408 — a checklist completed by a DCAA auditor based on a site visit and your responses to a companion document.
The auditor evaluates about fifteen criteria. Proper segregation of direct and indirect costs. A timekeeping system that identifies labor by project. Exclusion of unallowable costs. Monthly posting of costs. Similar attributes. The auditor then issues a recommendation to the contracting officer — acceptable, acceptable with conditions, or not acceptable. The contracting officer, not DCAA, makes the actual contract decision.
The pre-award audit is not automatic. The contracting officer requests it when a prospective contractor is being considered for cost-type work and either hasn't done government work before or hasn't done it recently. Once your system is found acceptable, that determination generally carries forward to your next cost-type contract.
The timeline is short. From the contracting officer's request to the auditor's report is typically about two weeks. The actual on-site fieldwork is usually one to two days. Most of the effort sits on your side — preparing policies, walking the auditor through the system, producing documents. Two weeks is not enough time to build a compliant system from scratch.
If findings are adverse, the contract is not "cancelled" — it just isn't awarded. There is no contract yet. The contracting officer typically has three paths:
- Award with conditions. For minor deficiencies, the contracting officer may award the contract anyway with a corrective action plan and a follow-up review to confirm remediation.
- Decline pending fixes. For significant deficiencies, the contracting officer may decline to award until your system is corrected. You can fix the issues and request a re-audit, but the original opportunity may have gone to a competitor.
- Award to another offeror. For fundamental gaps that cannot be fixed in time, the contracting officer awards to someone else.
The result in all three scenarios is the same: you lose the opportunity unless you can remediate fast. This is why pre-award readiness is something to build months — not weeks — before pursuing a cost-type contract.
Audits during and after the contract
Once you have a cost-type contract in performance, DCAA's attention turns to two main activities.
Floor checks are unannounced by design. A DCAA auditor walks in, asks to see specific employees, and verifies your timekeeping system in real time — that today's hours are recorded, that employees can describe what they are charging to, that supervisors are actively approving time, and that changes have a proper audit trail. The unannounced nature is intentional. The agency wants uncoached employee responses. The on-site portion typically lasts a few hours. Findings are usually communicated within two to three weeks of the visit. (A modern footnote: DCAA revised its procedures in 2022-2023 to allow scheduled floor checks for established, lower-risk contractors in some situations. New contractors should still expect the classic unannounced visit.)
Incurred cost audits are annual. Each year, contractors with cost-type contracts file an incurred cost submission within six months of fiscal year end. Once DCAA accepts the submission as adequate, the agency has up to twelve months to complete its audit. The audit checks whether your claimed costs meet federal standards. Timekeeping shows up here too, because labor is usually the largest single cost on a contract.
DCAA does not audit every submission. Since 2020, the agency has used risk-based sampling. Smaller contractors with clean submissions and lower dollar volume often receive a "low-risk memorandum" — a formal communication that establishes their final rates without a full audit. More on that below.
When findings are adverse on an existing contract, the consequences differ. You already have the contract, so the question isn't whether you get it. The question is what happens now. The standard path:
- Corrective Action Plan. The Administrative Contracting Officer (ACO) issues an Initial Determination Letter outlining the deficiencies. You respond with a corrective action plan covering remediation, timeline, and verification.
- Payment withholds. If your accounting or another business system is formally disapproved, the contracting officer can withhold up to 5 percent of payments on affected contracts — up to 10 percent if multiple business systems are disapproved. The withhold is released once corrective action is verified.
- Questioned and disallowed costs. Specific labor charges or other costs that cannot be substantiated may be questioned. If you cannot defend them, they become disallowed. You do not get reimbursed for those costs.
- Rare escalation. In cases involving deliberate misconduct — timesheet fraud, knowingly false certifications — consequences can escalate to False Claims Act exposure, contract termination, or debarment from federal contracting. These outcomes are reserved for clear intentional wrongdoing.
For most contractors with honest deficiencies, the contract is not cancelled. Remediation is the standard path. But remediating under audit pressure costs significantly more than building a compliant system in advance.
How often these audits actually happen
DCAA's published reporting gives a useful sense of scale. In fiscal year 2024, the agency issued 2,465 audit reports and 7,629 memos, examining $599.8 billion in contract costs and identifying $15.9 billion in audit exceptions. About 4,400 contractors were engaged out of roughly 7,000 active contractors that year.
The breakdown:
| Audit Category | Reports | Memos |
|---|---|---|
| Incurred Cost | 530 | 3,058 |
| Forward Pricing | 649 | 94 |
| Systems, CAS & TINA | 515 | 3,490 |
| Claims & Terminations | 771 | 987 |
| Total | 2,465 | 7,629 |
Source: DCAA Report to Congress on FY 2024 Activities (March 31, 2025).
Two things worth knowing about this table.
An audit report is a formal full audit with findings. A memo is a shorter formal communication — most often a low-risk memorandum that establishes your rates without a full audit. Memos are not lesser outcomes. They are the standard format for risk-based reviews.
SF 1408 audits and floor checks are not broken out as separate line items. DCAA reports audits by purpose, not procedure. Pre-award audits are folded into Claims & Terminations. Floor checks are folded into incurred cost or business system work. The specific counts for those procedures are not published.
The most useful takeaway: of roughly 3,588 incurred cost dispositions in FY 2024, only 530 — about 15 percent — resulted in full audit reports. The other 85 percent were closed with memos, most being low-risk memoranda. For a small contractor with a clean submission and a modest dollar volume, the most likely outcome each year is a low-risk memo, not an audit.
What this means for you
DCAA readiness is not something you build reactively. The pre-award window is too short to fix a deficient system. Floor checks are unannounced. Incurred cost audits review work that has already been performed. By the time an audit is in motion, your ability to influence the outcome is largely set by what you built months or years before.
If your company expects to pursue cost-reimbursement or T&M work in the next eighteen months, the time to start preparing is now. The next article in this series covers what that preparation looks like in practice — what an audit-ready timekeeping system requires, where small contractors most often fall short, what tools meet the requirement, and the cost of inadequate planning.