The Incurred Cost Audit, Explained for Small GovCons

For most small cost-reimbursable contractors, the incurred cost audit is the biggest DCAA review they will see. Here is what it is, how it runs, and what makes it manageable.

If you hold a cost-reimbursable contract, the incurred cost audit is the review that will ask the most of you. It happens after the year is over, and its purpose is to settle your annual indirect rates: to compare the indirect costs you billed provisionally against what you actually incurred. The submission itself is typically prepared using the DCAA's Incurred Cost Electronically (ICE) model, the standardized Excel template it provides for incurred cost proposals under FAR 52.216-7. Alongside the accounting system review, it is the audit a small contractor is most likely to face, and unlike that lighter review, it is where an auditor begins to dig.

Where It Starts: The Risk Assessment

Before any testing, the auditor performs a risk assessment. The goal is to understand your company before deciding how much audit work it needs: your system, your policies, your procedures, and the risk that something is not being done the way it should be.

In Paul's experience, small firms can get caught here, because the risk assessment is sometimes geared toward a larger company: you may be asked whether you have internal audits, formal controls, and other structures a major firm would have, and answering no to most of them is normal for a small contractor. He also describes a lengthy contractor information form the agency uses to get to know you, one that tends to repeat year over year. His practical tip is to complete these electronically, save them, and update only what changed the next time.

The Core Mechanic: You Do Not Choose the Sample

The single most important thing to understand about an incurred cost audit is that the contractor selects nothing. The auditor designs everything and performs all the sampling. After the risk assessment, the audit runs on an audit program, a defined set of steps, and the auditor pulls a sample of transactions for you to support.

That sample can be sizeable, sometimes fifty to a hundred items, and it can cover labor, non-labor, and general ledger entries alike. In practice the rhythm looks like this: the auditor comes in, runs initial walkthroughs, asks questions, and then goes quiet. Weeks later, a sample selection arrives with a request to pull the supporting documents. You do not know in advance what they will select, so the only defense is a system that lets you retrieve any document quickly.

The Deadline Risk

Because the audit runs on the auditor's schedule, the one thing inside your control is how fast you respond to document requests, and it matters more than contractors expect. This is covered in depth in answering DCAA document requests before they cost you, but the short version belongs here too: missing due dates can lead the auditor to treat costs as unsupported, which means questioned or disallowed. If a deadline is genuinely too tight, it is reasonable to ask for more time. Letting the date pass without a response is what causes damage.

What Makes an Incurred Cost Audit Manageable

Nothing about the incurred cost audit rewards guessing what the sample will be. What it rewards is a system where every cost is already classified correctly and every figure is traceable to its source. That means direct and indirect costs cleanly segregated into pools, indirect rates you can calculate and defend, and labor tied to the right contracts through a documented labor distribution process.

FAQ

The DCAA review that settles your annual indirect rates, comparing the indirect costs you billed provisionally against what you actually incurred, prepared using the DCAA's Incurred Cost Electronically (ICE) model.

No. The auditor designs everything and performs all the sampling. You don't know in advance what they'll select; the sample can run fifty to a hundred items across labor, non-labor, and general ledger entries.

Missing due dates can lead the auditor to treat costs as unsupported: questioned or disallowed. If a deadline is genuinely too tight, ask for more time; letting the date pass without responding is what causes the damage.

A system where every cost is already classified correctly and traceable: direct and indirect costs cleanly segregated into pools, indirect rates you can calculate and defend, and labor tied to the right contracts through a documented process.

This is where WiseCost helps. Working on top of QuickBooks Online, it distributes labor to the right cost objectives, calculates your indirect rates from actual costs, and keeps an immutable audit trail behind every journal entry, so when a sample selection lands, the supporting documents are already there to pull, exportable and traceable.

Get the DCAA audit-readiness resource. The DCAA Master Audit Program 17740 is the actual program a DCAA auditor follows for the pre-award accounting system review. See it paired with a one-page WiseCost version and an interactive readiness checklist in The DCAA Pre-Award Accounting System Review: What the Auditor Actually Checks.

You can also run our free DCAA Readiness Self-Assessment to check whether your books could support a sample request, or book a demo to see how WiseCost keeps costs traceable.

Based on the DCAA Ready webinar series, featuring Paul Calabrese, a former DCAA auditor (GRF CPAs & Advisors).