DCAA compliance means an accounting system that satisfies the 18 criteria in DFARS 252.242-7006. It stops being optional when you accept a cost-reimbursement, incentive, time-and-materials, or labor-hour contract. Nothing about it is a certificate you hang on the wall. Instead, the Defense Contract Audit Agency audits your books and writes a report. Your contracting officer is then the person who approves or disapproves the system. I have watched small firms spend a year chasing a credential that does not exist. Meanwhile the actual requirement sat unfinished, which is a chart of accounts that separates direct cost from indirect cost.
What follows is what the regulations say about DCAA compliance, in the order a small contractor meets them. One change also lands on October 1, 2026. The basic Cost Accounting Standards threshold rises from $2.5 million to $35 million. As a result, roughly 30 percent of currently covered entities drop out of full coverage.
What does DCAA compliance mean?
DCAA is an audit agency, not a certifying body. It operates under the authority, direction, and control of the Under Secretary of Defense (Comptroller). Its job is to review the financial representations defense contractors make. From those reviews it helps decide whether claimed costs are allowable, allocable, and reasonable. In fiscal year 2025 it issued 2,480 audit reports and 7,047 memoranda covering $788.4 billion in contract costs. It also reported $5.3 billion in savings against $707.9 million in funding.
What the agency does not do is approve your system. DFARS 242.7502(b)(1) puts that decision somewhere else. It assigns the cognizant contracting officer, in consultation with the auditor, to “determine the acceptability of a contractor’s accounting system and approve or disapprove the system.” So the auditor documents findings and recommendations in a report. Then the contracting officer decides.
Two consequences follow, and both save money. First, no software is DCAA approved or DCAA certified, because DCAA does not issue approvals to products. A vendor can build features that make the 18 criteria easier to satisfy, and that is a real benefit. The phrase on the pricing page is still marketing rather than a credential. Second, there is also no general registry of compliant contractors. Instead, your system is approved on one contract, by one contracting officer, after an audit.
Which contracts trigger DCAA compliance?
The requirement rides on contract type rather than on company size or agency. DFARS 242.7502(a) names the triggers. A contractor must maintain an accounting system if it holds a cost-reimbursement, incentive type, time-and-materials, or labor-hour contract. The same duty also attaches to a contract with progress payments based on cost, or on a percentage or stage of completion. Likewise, FAR 16.301-3(a)(3) reaches the same point from the government side. A contracting officer can use a cost-reimbursement contract only when the contractor’s accounting system is adequate for determining costs applicable to that contract.
Read that as a gate rather than a warning. A contracting officer who cannot establish that your system is adequate cannot award you the cost-reimbursement work, whatever your technical score. However, firm-fixed-price work carries no such gate. FAR 16.301-3(b) goes further and prohibits cost-reimbursement contracts for commercial products and commercial services. So a firm that sells only commercial items on fixed-price awards might never meet DCAA at all.
When DCAA compliance applies, by contract type
| Contract situation | Accounting system required? | CAS applies? | Authority |
|---|---|---|---|
| Commercial products or services, fixed-price | No | No | FAR 16.301-3(b), 48 CFR 9903.201-1(b)(6) |
| Firm-fixed-price on adequate price competition, no certified cost or pricing data | No | No | 48 CFR 9903.201-1(b)(15) |
| Progress payments based on cost or stage of completion | Yes | Only if CAS-covered | DFARS 242.7502(a) |
| Time-and-materials or labor-hour | Yes | Only if CAS-covered | DFARS 242.7502(a) |
| Cost-reimbursement or incentive type | Yes | Only if CAS-covered | DFARS 242.7502(a), FAR 16.301-3(a)(3) |
| Any of the above, awarded to a small business | Yes, where the type triggers it | No, exempt from all CAS | 48 CFR 9903.201-1(b)(3) |
So the first question to ask about DCAA compliance is not how to achieve it. It is which opportunities in your pipeline are cost-type at all. That answer changes what you have to build. In fact, many small firms find that the easiest federal work to win is fixed-price and needs none of this.
What are the 18 accounting system criteria for DCAA compliance?
DFARS 252.242-7006 (Jan 2025) is the clause, and paragraph (c) is the checklist. The clause defines what the system has to assure. Laws and regulations are complied with, and the accounting system and the cost data are reliable. The system also keeps the risk of misallocation and mischarging to a minimum, and it keeps contract allocations and charges in line with billing procedures. So the 18 criteria below are the test the auditor applies and the contracting officer relies on.
Controls, cost structure, and the ledger (criteria 1 to 8)
| # | Criterion (DFARS 252.242-7006(c)) | What it means in a small firm |
|---|---|---|
| 1 | Sound internal control environment, accounting framework, and organizational structure | Written policies, and someone other than the person who books a cost reviewing it |
| 2 | Proper segregation of direct costs from indirect costs | The single most common deficiency. Two account groups, no shared buckets |
| 3 | Identification and accumulation of direct costs by contract | A job-cost structure with one code per contract |
| 4 | Logical and consistent accumulation and allocation of indirect costs | Defined pools and bases, applied the same way every month |
| 5 | Accumulation of costs under general ledger control | Job cost ties to the general ledger, not to a spreadsheet beside it |
| 6 | Reconciliation of subsidiary cost ledgers and cost objectives to the general ledger | A monthly reconciliation you can show |
| 7 | Approval and documentation of adjusting entries | No unsigned journal entries |
| 8 | Management reviews or internal audits of the system | A documented self-check against your own written procedures |
Labor, billing, and reporting (criteria 9 to 18)
| # | Criterion (DFARS 252.242-7006(c)) | What it means in a small firm |
|---|---|---|
| 9 | A timekeeping system that identifies labor by intermediate or final cost objective | Every hour worked charged to a code, including unbilled overhead time |
| 10 | A labor distribution system that charges direct and indirect labor correctly | Timecards flow into the ledger without manual reallocation |
| 11 | Interim determination of costs charged to a contract, at least monthly | Books closed monthly, not at year end |
| 12 | Exclusion of costs unallowable under FAR part 31 | Unallowable accounts that never reach a billing rate |
| 13 | Identification of costs by contract line item and by unit, if required | CLIN-level cost when the contract asks for it |
| 14 | Segregation of preproduction costs from production costs, as applicable | Relevant to manufacturers, not to most service firms |
| 15 | Cost accounting information required by FAR 52.232-20, 52.232-22, and 52.216-7 | Limitation of cost notices, and rates you can compute from the books |
| 16 | Billings reconcilable to the cost accounts, current and cumulative | Every voucher traceable to the ledger |
| 17 | Adequate, reliable data for pricing follow-on acquisitions | Last year’s actuals available to price next year’s bid |
| 18 | Accounting practices per Cost Accounting Standards if applicable, otherwise GAAP | For most small firms this reads as GAAP, because CAS exempts small business |
Criteria 2, 9, and 12 carry most of the DCAA compliance findings I have seen. They are also the three that general-purpose bookkeeping handles worst. Commercial accounting has no reason to care whether an hour of unbilled administrative time landed in a pool.
How do you get an accounting system approved before award?
Through a preaward survey. FAR 53.209-1(f) prescribes Standard Form 1408, Preaward Survey of Prospective Contractor — Accounting System. The form is also public in the GSA Forms Library. During the survey, an auditor walks your books against the criteria. The report then puts the system in one of three states for that award. Permitted as it stands, permitted with conditions, or not permitted.
You do not request the survey, and you also cannot schedule one in advance. FAR 9.106-1(a) sets two limits on it. A preaward survey normally happens only when the information already available to the contracting officer will not support a responsibility determination. The second limit covers fixed-price awards at or below the simplified acquisition threshold, and commercial acquisitions. There the contracting officer withholds the request unless the cost is justified. In practice the survey arrives because you are in line for a cost-type award, on the government’s schedule rather than yours.
Which means the DCAA compliance work happens before the survey exists. Build the account structure. Run it for a few closed months, so the reconciliations are real. Then write the procedures down and keep the timecard evidence. A system with three clean monthly closes behind it is a different conversation from a chart of accounts built the week the auditor called. Put your SAM.gov registration in order at the same time, because the responsibility determination looks at both.
What costs are unallowable under FAR part 31?
Criterion 12 sends you to FAR part 31, and FAR 31.201-2(a) sets the test. A cost is allowable only when it satisfies five things at once. Reasonableness, allocability, the Cost Accounting Standards or otherwise GAAP, the terms of the contract, and the limitations in subpart 31.2. FAR 31.201-2(d) then adds the part that decides audits. The contractor keeps records adequate to show that a claimed cost was incurred and is allocable. A contracting officer can disallow any claimed cost that is inadequately supported.
Unallowable costs that most often trip up DCAA compliance
Subpart 31.205 then works through 52 categories of selected costs. The ones below put small firms in trouble most often. Each is an ordinary business expense, so a commercial bookkeeper has no reason to isolate it.
| Cost | FAR cite | Why it catches small firms |
|---|---|---|
| Entertainment | 31.205-14 | Client dinners and tickets, often coded to business development |
| Alcoholic beverages | 31.205-51 | Rides along on an otherwise allowable travel or meal receipt |
| Fines, penalties, and mischarging costs | 31.205-15 | Late tax penalties sit in the general ledger by default |
| Interest and other financial costs | 31.205-20 | Line-of-credit interest, the classic small-firm finding |
| Lobbying and political activity | 31.205-22 | Trade-association dues that fund advocacy need splitting |
| Contributions or donations | 31.205-8 | Charitable giving booked as community relations |
| Public relations and advertising | 31.205-1 | Allowable in part only, so the account has to be split |
| Organization costs | 31.205-27 | Legal fees for reorganizing or raising capital |
| Bad debts | 31.205-3 | A write-off that commercial practice treats as routine |
| Costs related to legal and other proceedings | 31.205-47 | Allowability turns on the outcome of the proceeding |
So the structural answer is an unallowable account alongside each allowable one, populated as the cost is booked. In contrast, screening a year of transactions in month seven is how expressly unallowable costs reach a rate proposal, and FAR 42.709 prices that mistake.
What is the incurred cost submission and when is it due?
It is the annual true-up on a cost-reimbursement contract, and FAR 52.216-7(d)(2)(i) sets the deadline. You submit an adequate final indirect cost rate proposal to the contracting officer and to the auditor. The window is the six-month period after the end of each of your fiscal years. Extensions come in writing, for exceptional circumstances only. For example, with a December fiscal year end, the date is June 30.
What makes the submission adequate
“Adequate” is defined rather than judged. FAR 52.216-7(d)(2)(iii) lists 15 schedules. They run from a summary of claimed indirect rates to a reconciliation of total payroll per IRS Form 941 against total labor cost distribution. Also in the list are a schedule of direct costs by contract and subcontract, and closing information for every contract physically completed that year. The certificate of final indirect costs at FAR 52.242-4 then goes on top. FAR 42.703-2(a) bars the government from settling rates without that certificate.
Data table: accounting and audit deadlines with their citations
| When | What is due | Authority |
|---|---|---|
| Before award | Preaward survey of the accounting system on Standard Form 1408 | FAR 53.209-1(f), FAR 9.106-1 |
| Every 2 weeks | Interim cost vouchers. A small business concern can bill more often | FAR 52.216-7(a)(1) and (c) |
| Monthly | Costs posted to the books and reconciled to the general ledger | DFARS 252.242-7006(c)(6) and (c)(11) |
| 6 months after fiscal year end | Final indirect cost rate proposal, 15 schedules, and the certificate | FAR 52.216-7(d)(2), FAR 52.242-4 |
| Within 12 months of a qualified submission | Completion of the incurred cost audit | 10 U.S.C. 3842(b)(1)(B) |
| 30 days, then 45 days | Response to an initial determination, then correction or a corrective action plan | DFARS 252.242-7006(d) and (e) |
Audit timing and interim billing
After submission the auditor reviews adequacy first. Any inadequacies come back to you and the contracting officer in writing, per FAR 42.705-1(b)(1)(iii). Then the clock that matters to your cash starts. Under 10 U.S.C. 3842(b)(1)(B) an incurred cost audit is to finish no later than one year after receipt of a qualified submission. DCAA also reported a 25 percent cut in hours to complete these audits in fiscal year 2025. Until rates are final, fee on completed work stays unsettled and contracts stay open.
Meanwhile, interim cash runs on a separate rhythm. FAR 52.216-7(a)(1) limits payment requests to once every two weeks. Paragraph (c) then carves small business out, because a small business concern can bill more often than that. It is a real working-capital advantage, yet almost nobody claims it.
What happens if you fail a DCAA audit?
A DCAA compliance failure has a defined shape, and the shape is slower than the rumor. Under DFARS 252.242-7006(d) the contracting officer issues an initial written determination. It describes each material weakness in enough detail so that you can understand it. You then have 30 days to respond in writing, and to state your rationale if you disagree. The contracting officer then evaluates that response and issues a final determination. If a material weakness remains, paragraph (e) gives you 45 days from receipt. In that window you either correct the weakness or hand over a corrective action plan with milestones that the contracting officer accepts.
Payment withholding is the sanction behind that process. Here company size changes the answer. DFARS 252.242-7005(a) narrows the clause. It “only applies to covered contracts that are subject to the Cost Accounting Standards.” Where it does apply, the contracting officer withholds 5 percent of amounts due from progress payments, performance-based payments, and interim cost vouchers. That drops to 2 percent once you are effectively implementing an accepted corrective action plan. The ceiling is 5 percent for weaknesses in any single business system, and 10 percent across multiple systems.
The cost-side penalty, however, has a lower bar. FAR 42.709-1(b) reaches every contract over $1 million. FAR 42.709-2(a) then prices an expressly unallowable indirect cost at the disallowed amount allocated to covered contracts, plus interest on any paid portion. The penalty doubles if that same cost had already been determined unallowable for your company before you submitted. FAR 42.709-2(b) also adds that these penalties sit on top of other administrative, civil, and criminal remedies. A disapproved system also lands in the past-performance record, a separate problem covered in the CPARS guide.
Do the Cost Accounting Standards apply to a small business?
No, and this is the most useful sentence in the guide. 48 CFR 9903.201-1(b)(3) exempts “Contracts and subcontracts with small businesses” from all CAS requirements. There is no dollar qualifier and no condition on it. So criterion 18 reads as GAAP for a small firm, and the Disclosure Statement does not apply. The business systems withholding clause cannot attach either, because it reaches only CAS-covered contracts. What still remains is the core of DCAA compliance, the accounting system requirement itself. As a result, most of the fear about CAS is spent in the wrong place.
The October 1, 2026 CAS rule keeps the exemption
The exemption also survives the rewrite arriving in six days. On September 1, 2026 the Cost Accounting Standards Board published a final rule at 91 FR 56056, effective October 1, 2026. It raises the basic CAS threshold and also republishes the exemption list. Paragraph (b)(3) comes through unchanged. The rule’s own Regulatory Flexibility analysis restates it: “Contracts and subcontracts with small business concerns are exempted from all CAS requirements.”
What does change matters to firms that have outgrown the size standard.
| CAS provision | Through Sept 30, 2026 | From Oct 1, 2026 |
|---|---|---|
| Basic monetary threshold, 9903.201-1(b)(2) | Tied to the Truthful Cost or Pricing Data statute threshold | A stated $35 million |
| Trigger-contract concept ($7.5 million) | In force | Eliminated |
| Full versus modified coverage and Disclosure Statement, 9903.201-2 | $50 million | $100 million |
| Agency head waiver authority, 9903.201-5(a) | $15 million | $100 million |
| Small business exemption, 9903.201-1(b)(3) | Exempt from all CAS | Exempt from all CAS |
| Entities under full coverage | 773 entities, $1.22 trillion in value | 564 entities, $1.21 trillion in value |
How the new rule tests indefinite-delivery contracts
Roughly 30 percent fewer entities under full coverage, and under 1 percent of the covered dollars released. The rule also settles how the exemptions get tested on indefinite-delivery contracts. On a multiple-award vehicle the test happens at each task or delivery order, against that order’s ceiling value. On a single-award vehicle it instead happens once, at award of the base contract, against the contract ceiling. If you hold single-award work with a large ceiling and small orders, read that paragraph closely. A companion rule at 91 FR 56061 also rescinds CAS 407 on the same date.
How much audit work is behind these rules?
Enough to explain the timelines, and not enough to explain the anxiety. In a typical year DCAA engages with more than 4,400 contractors, out of a population of roughly 7,000 active contractors. It does that with about 3,778 authorized personnel across just under 200 offices. In fiscal year 2024 it issued 530 incurred cost audit reports examining $256 billion. Another 649 forward pricing proposal audit reports covered $125 billion in proposed costs. Total audited that year came to about $599 billion.
Data table: DCAA contract costs audited by program, FY2024
| Audit program | Contract costs audited, FY2024 | Reports issued |
|---|---|---|
| Incurred cost audits | $256 billion | 530 |
| All other audit programs | $218 billion | Not reported separately |
| Forward pricing proposals | $125 billion | 649 |
| Total audited | About $599 billion | Not reported separately |
Set that against $778.5 billion in federal prime contract obligations in fiscal year 2025, per USASpending.gov. Most federal buying never reaches an incurred cost audit, because most of it is fixed-price. The agency also reorganized in October 2025. A headquarters with eight geographic subordinate organizations became three functional ones, built around air, land, and sea capabilities. So the office that audits you might not be the office that audited you in 2024.
DCAA compliance is buildable, but finding work that justifies it is the hard part.
Everything above is a finite build. An account structure, a timekeeping rule, unallowable accounts, a monthly close, and one honest submission six months after year end. A competent government-contract bookkeeper gets a small firm there in a quarter. The problem that follows, however, resists a checklist. The overhead pays for itself only if you win cost-type and time-and-materials work often enough to amortize it. Finding that work means reading solicitations rather than titles.
Contract type is rarely in the notice headline. Instead, it sits in Section B, or in an attached pricing schedule, or in a clause list that includes FAR 52.216-7. Another question hides in Section L or M. Does the solicitation demand an approved accounting system at award? Or will it take one permitted with conditions? So keyword and NAICS search misleads a firm that has just built an accounting system. The filter that matters is not one of the fields the portal exposes. Procura Federal opens the attachments and pulls out the pricing type and the clause list. It rates the opportunity against your capability statement, and it names the compliance duties that opportunity carries, at $399/month. Firms use it to settle one question fast. Is this particular opportunity worth the DCAA compliance overhead they now carry?
The step-by-step guide to winning government contracts sets out the wider sequence, from registration through award. The federal contracting glossary also defines the clause numbers above.
Frequently asked questions about DCAA compliance
Is any accounting software DCAA approved?
No. Approval attaches to a contractor’s system on a contract, granted by a contracting officer under DFARS 242.7502(b)(1). It never attaches to a product. Software that enforces job costing, daily timekeeping, and separate unallowable accounts does make the DCAA compliance criteria easier to meet. That is worth paying for on its own terms.
Can I win a federal contract without DCAA compliance?
Yes, on firm-fixed-price work, which is the majority of federal buying and the whole of commercial-item buying. The accounting system requirement attaches to cost-reimbursement, incentive, time-and-materials, and labor-hour contracts, and to contracts with cost-based progress payments.
Does a subcontractor need an approved accounting system?
It depends on the subcontract type your prime issues rather than on the prime contract type. A fixed-price subcontract under a cost-reimbursement prime carries no accounting system requirement for you. A cost-type or time-and-materials subcontract does carry one, so the prime will test it.
How long does an accounting system audit take?
Neither the FAR nor the DFARS sets a deadline for the audit itself. Instead, the deadlines in the rules run the other way and bind you. You get 30 days to answer an initial determination of material weakness. You then get 45 days to correct it or produce a corrective action plan.
What is the difference between DCAA and DCMA?
DCAA audits and recommends. DCMA instead administers contracts and supplies the contracting officers who act on those recommendations. Those officers make the determination to approve or disapprove a system, and give the direction to withhold payments. An unfavorable audit finding is not a decision until a contracting officer adopts it.
Do other compliance regimes overlap with DCAA compliance?
They run on separate tracks with separate triggers. Cybersecurity duties follow the information in the contract rather than its pricing type, as the CMMC Level 1 guide sets out. Wage rules such as the Service Contract Act follow the type of work instead. A schedule award also brings its own reporting, covered in the GSA Schedule guide.
Get the pipeline side right before you buy more overhead
Book a working session and bring two or three opportunities you are weighing. We then read the solicitations and their attachments together. Out come the pricing type, the clause list, and the accounting system language. Then you know which of them actually needs the system you are building. It is a faster answer than another compliance webinar, and it costs nothing.
