Why this matters even without a DoD contract
The Defense Contract Audit Agency (DCAA) technically only audits Department of Defense contracts. But civilian agencies — GSA, HHS, DOE, and others — routinely rely on DCAA's audit findings, or ask their own auditors to apply DCAA's standards, because it's a well-established, defensible framework.
If your accounting system and indirect rate structure would pass DCAA scrutiny, you're in good shape almost regardless of which agency you contract with. If they wouldn't, you're exposed even on contracts where DCAA will never show up.
The real goal: don't give them a reason to look closer
DCAA doesn't audit every contractor every year. Audits get triggered by red flags — inconsistent rates, unsupported costs, disorganized submissions, prior findings, or a contract type and dollar value that crosses a threshold.
The single biggest lever a small contractor has is making sure that if DCAA does look, what they find is clean enough to close the file quickly.
1. Have written policies for overhead, fringe, G&A, and unallowable costs
This is the foundation. DCAA auditors expect to see documented, consistently applied policies — not case-by-case judgment calls. At minimum, your firm should have:
- A written accounting policy manual describing how costs are classified (direct vs. indirect) and how each indirect pool is defined
- A clear, documented cost allocation methodology for overhead, fringe, and G&A — and evidence that you actually follow it
- An explicit unallowable costs policy referencing FAR 31.205, with a process for identifying and excluding items like entertainment, alcohol, lobbying, certain marketing costs, and interest expense from your indirect pools
- Timekeeping policies that meet DCAA's standards (daily time entry, employee certification, supervisor approval, corrections logged with an audit trail)
Contractors get flagged far more often for inconsistency than for any single cost being disallowed. If your fringe pool calculation changes methodology from quarter to quarter with no explanation, that's a red flag even if every dollar in it is legitimate.
2. Keep your accounting system itself audit-ready year-round
This isn't a once-a-year task. DCAA (and any agency deferring to DCAA's standards) expects your accounting system to be capable of accumulating and segregating costs correctly in real time, not reconstructed after the fact. That means:
- A general ledger structure that separates direct costs by contract, and indirect costs by pool, as transactions happen
- Timekeeping that's contemporaneous, not backfilled
- A documented, tested process for allocating indirect costs to final cost objectives
- Regular reconciliation between your job cost/project accounting and your GL
3. Don't let small errors become patterns
A single misclassified expense is a correction. The same type of misclassification recurring across multiple periods looks like a systemic control weakness — which is what invites a broader look. Build a quarterly self-review into your process: sample transactions in each indirect pool, confirm they're properly classified, and catch drift before year-end.
The bottom line
Contractors who get audited hardest are usually the ones who look disorganized on paper, not necessarily the ones with the biggest dollar exposure. Clean, consistent, well-documented policies and an accounting system that stays reconciled year-round are the most effective audit-avoidance strategy available to a small contractor.
Want help putting this in place?
I write accounting, allocation, unallowable cost, and timekeeping policies for small and mid-sized government contractors, and build the chart of accounts and rate structure behind them.
Related: Why fixed-price and T&M contractors still need to calculate indirect rates →