DCAA Compliance· · 7 min read
Which DCAA Audit Will You Actually Face? A Small Contractor's Map
Which DCAA review you encounter depends heavily on your contract type. A former DCAA auditor maps the accounting system review, incurred cost audit, and proposal audit.
Much of the anxiety around the Defense Contract Audit Agency comes from not knowing which review applies to you. Here is how the pieces fit together for a small contractor, and why readiness matters more than prediction.
The Defense Contract Audit Agency has a fearsome reputation, but for most small contractors the practical question is narrower than the fear suggests: which review might actually apply to my company, and what does it involve? The landscape below draws on Paul Calabrese, a former DCAA auditor now in public accounting, who walked through it in our DCAA Ready webinar series. The throughline is that your contract mix shapes what you are likely to encounter, and that the work of preparing happens before any review begins.
How Contract Type Shapes DCAA Involvement
Drawing on Paul's experience as a former auditor, the type of contract you hold is what tends to determine whether, and how, the DCAA gets involved. Cost-reimbursable contracts, such as cost-plus-fixed-fee, are the ones most associated with the agency getting involved, and generally when you are the prime, the entity running the contract. Contractors who work only in fixed-price or time-and-materials often notice they rarely deal with the DCAA at all, and in his account that is because direct involvement tracks much more closely with cost-reimbursable work. Subcontractors likewise tend to have less direct involvement than primes, though the picture here can be more nuanced than a single rule captures.
None of this is a guarantee about any specific contract. It is the pattern a former auditor sees, and the useful takeaway is directional: the more your work moves toward cost-reimbursable, the more likely the DCAA becomes part of your world, and the more it pays to be ready in advance. That is a theme we cover in depth in do you need to be DCAA-compliant before you win a contract?
A note on SBIR and STTR
One path small businesses often overlook runs through the Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programs, which fund early-stage research and development for small firms. A company can begin with a fixed-price early phase and then move into cost-reimbursable work in later phases, and that transition is the point at which the government is likely to look closely at whether your accounting system is ready.
Here's the map at a glance:
| Audit type | When it happens | What it checks | Most likely trigger |
|---|---|---|---|
| Accounting System Review (SF-1408) | Pre-award, before you're relied on for cost-reimbursable billing | Whether your system segregates direct/indirect costs, accumulates by contract, and can produce required reports | Cost-reimbursable contracts (e.g., cost-plus-fixed-fee), especially as prime |
| Incurred Cost Audit | After the contract year ends | Settles annual indirect rates against what you actually spent; may include a floor check | Cost-reimbursable work already in place |
| Proposal Audit | During a specific bid, once it's far enough along | The cost proposal and its backup documentation | Bidding on a cost-reimbursable contract |
The Accounting System Review (SF-1408)
When the government needs to confirm your accounting system can handle cost-reimbursable work, it uses the SF-1408, a pre-award survey of a prospective contractor's accounting system. The word pre-award matters: this review is oriented around a question asked before you are relied on for cost-reimbursable billing, which is exactly why readiness cannot wait until after you win. It confirms that your books segregate direct and indirect costs, accumulate costs by contract, and can produce the reports the government needs, and a common part of it is asking to see, live, how you generate a report out of your accounting system.
It is not designed to be a difficult review, and a good first step is simply to read the SF-1408 itself, since it lays out what a compliant system has to do. For how to build books that meet it, see our complete guide to DCAA-compliant accounting systems and the right chart of accounts for GovCon in QuickBooks Online.
The criteria this review applies are public and specific. For the full list of what an auditor verifies, and what to have ready for each, see the DCAA pre-award accounting system review: what the auditor actually checks, which includes an interactive readiness checklist and the free audit program resource.
The Incurred Cost Audit
For small contractors with cost-reimbursable work, the incurred cost audit is the largest review they are likely to see. It happens after the year is over, to settle your annual indirect rates against what you actually spent, and it is where an auditor begins to dig into your transactions rather than just confirming your system exists. As part of it, on a cost-reimbursable contract, the DCAA may also conduct a floor check, a live check of your timekeeping.
Because it carries the most work for a small contractor, we cover it on its own in the incurred cost audit, explained for small GovCons.
The Proposal Audit
A proposal audit occurs when the DCAA reviews the cost proposal behind a bid. The arrival of one is generally good news, since it tends to mean your proposal is far enough along that winning is a real possibility. The avoidable failure is being unable to produce the backup documentation behind your proposed numbers.
How a DCAA Review Actually Runs
In Paul's experience, a review today is mostly remote. Rather than knocking on your door, auditors generally begin over Zoom or Teams with an entrance conference, followed by a walkthrough, a prearranged meeting where they see how your system works. On-site audits still happen, but at large contractors rather than small ones.
Two things about the process are worth internalizing. First, the contractor selects nothing: the auditor performs the risk assessment, designs the audit program, and chooses the sample, and your role is to respond and pull the documents requested. Second, the review is not adversarial by design. Before testing anything, the auditor works to understand your system, policies, and procedures, which is how they gauge how much audit work your company needs.
Being Ready Before a Review Begins
The practical lesson across every review is that readiness is not about predicting the sample. It is about having a system, and the controls behind it, in place before anything begins, ideally before you even win the cost-reimbursable work that triggers a review. That means internal controls in the form of written policies and procedures, and a system that can actually do the work: job cost, labor distribution, the ability to bill, and the ability to calculate indirect rates.
"If you're hoping, it's too late."
Paul Calabrese, a former DCAA auditor
Readiness also has a cost, and it is worth planning for rather than being surprised by. Signing a cost-reimbursable contract means stepping into a world of compliance, and small firms, with limited resources, still have to invest in meeting it, including in the software that does the parts a spreadsheet cannot do reliably. The downside of waiting is not abstract: when a review turns up problems, the agency can write up deficiencies, which we cover in what happens when a DCAA audit finds deficiencies.
How WiseCost Fits
That readiness is where WiseCost fits. It layers on top of QuickBooks Online to provide the pieces the SF-1408 looks for and an auditor asks to see: compliant timekeeping and labor distribution, a segregation of direct and indirect costs, calculated indirect rates, and an immutable audit trail behind every figure, all exportable when a review begins. You keep your books in QuickBooks Online, and the structure underneath them is what makes a review manageable.
Get the DCAA audit-readiness resource. The DCAA Master Audit Program 17740 is the actual program a DCAA auditor follows for the pre-award accounting system review. See it paired with a one-page WiseCost version and an interactive readiness checklist in The DCAA Pre-Award Accounting System Review: What the Auditor Actually Checks.
You can also run our free DCAA Readiness Self-Assessment to see whether your books would meet an SF-1408 review, or book a demo to see how WiseCost keeps you audit-ready.
Based on the DCAA Ready webinar series, featuring Paul Calabrese, a former DCAA auditor.