Government contracting
8 DCAA Compliance Mistakes First-Time Federal Contractors Make
None of these are exotic. They are the ordinary habits of a business that has never had a federal contract before, and every one of them is cheaper to fix now than to explain later.
Nobody makes these mistakes because they are careless. They make them because the way you have always run timesheets was fine, right up until the day you signed a federal contract.
Here are the eight that catch people out most often, what each one actually costs, and the version to do instead. Most take an afternoon to fix. All of them take considerably longer than that once an auditor has asked.
The short version
- Total hours are not an answer. Forty hours means nothing without knowing where they went.
- Friday reconstruction is the single most common one. A week rebuilt from memory is a recollection, not a record.
- Overwriting a timesheet destroys the thing an auditor wants. The old value is the evidence.
- Your accounting software is not the same as a timekeeping system. They do different jobs and you need both.
- Being small is not a defense. The rules follow the contract type, not the headcount.
1. Waiting until an audit to think about any of this
What it sounds like: “We will tidy it up if somebody actually asks.”
It is a reasonable instinct and it is the most expensive one on this list. The problem is that tidying up is not available to you. You cannot go back and record what somebody was doing eight months ago, because the only person who knew is the employee and they have forgotten. What you can produce is an estimate, and an estimate is exactly what an auditor is testing for.
There is also a rule sitting underneath this. FAR 31.201-2(d) requires records adequate to demonstrate that claimed costs were incurred and are allocable to the contract, and closes by saying the contracting officer may disallow all or part of a cost that is inadequately supported.
Do this instead: set the structure up in the first month, before anyone charges an hour. It is roughly an afternoon of work, and our guide to what to set up after a federal award walks the whole thing.
2. Recording total hours and stopping there
What it looks like: John, 40 hours. Approved.
True, useless. The clause that governs this asks for a timekeeping system that identifies employees’ labor by intermediate or final cost objectives, which in plain terms means every hour has to land on something named.
| What you have | What you need |
|---|---|
| John, 40 hours | Contract A, 25 · Contract B, 8 · Admin, 3 · Business development, 4 |
Do this instead: set up your projects and your overhead categories once, so choosing is a dropdown rather than a decision. In TimeRewards that is a project per contract and a short list of indirect codes underneath it, and once it exists your team never thinks about it again.
3. Reconstructing the week on Friday afternoon
What it sounds like: “What did I do Monday? Six hours on the government job, I think.”
This is the most common of the eight and the easiest to fix. DCAA’s own manual for contractors asks that employees record their time on a timesheet on a daily basis, and every way labor gets tested assumes it. When an auditor asks somebody what they are working on and compares the answer to the timesheet, a record written on the day holds up. One rebuilt on Friday is a guess with a signature on it.
Do this instead: make entry the last thing people do before they close their laptop. It takes under a minute when the projects are already set up, and TimeRewards chases the people who forget so you do not have to.
4. Letting managers change timesheets freely
What it looks like: A manager spots that someone charged Contract A instead of Contract B, opens the timesheet, and fixes it.
The correction is right. The way it was made destroys the record. An overwrite leaves no trace that the entry ever said something else, and the history is the part an auditor actually wants.
DCAA asks that changes are documented with the original charge, the corrected charge, and evidence the employee agreed to it. There is a second problem too: a supervisor should be prohibited from completing an employee’s timesheet outside a prolonged absence on authorized leave.
What this looks like in practice
A correction in TimeRewards is not an overwrite. The previous value stays on the record next to the new one, with the person who made the change, the timestamp and the reason they gave. The employee sees it and confirms it.
Nobody has to remember to keep a history, which is the whole point. Controls that depend on someone remembering are the ones that quietly stop working in month four. DCAA-compliant timesheets are included on every plan, including the entry tier.
5. Calling every non-billable hour “overhead”
What it looks like: One bucket called Overhead, and everything that is not billable goes in it.
Overhead is not one thing. Administration, management, internal IT, business development, training and paid leave behave differently in your rate calculations, and pooling them means you cannot show how any single one was arrived at. It also hides the number most owners actually want, which is how much time the business spends winning work rather than doing it.
Do this instead: decide five or six named indirect categories before anyone starts charging time, and keep the list short enough that people pick correctly without asking. Our guide to DCAA timekeeping requirements covers where the line between direct and indirect actually falls, including the cases that could go either way.
6. Assuming your accounting software has this covered
What it sounds like: “We run everything through QuickBooks, so we should be fine.”
QuickBooks, Sage Intacct and BambooHR are good products doing the jobs they were built for. None of them was built to be a DCAA timekeeping system, and that is not a criticism of any of them. Accounting software records what a cost was. A timekeeping system records who said so, when they said it, and what changed afterward.
The gap shows up in specific places: daily entry by the employee rather than an admin, separate direct and indirect coding at the point of entry, approval routed to someone other than the person who entered it, and a full history on every correction.
Do this instead: keep the accounting system you have and put a timekeeping system in front of it. TimeRewards syncs approved time and expenses into QuickBooks on every plan, and into Sage Intacct on Professional and above, so the hours reach your books without anyone retyping them and the trail stays intact from entry to invoice.
7. Never telling your team any of this
What it looks like: A perfectly configured system, and nobody who charges time knows what the codes mean.
This one is worth more attention than it usually gets, because of how DCAA actually tests labor. A floor check is an unannounced visit where an auditor walks around, asks people what they are working on, and compares the answers to what those people charged. The system is not being interviewed. Your staff are.
They need to know five things: what to charge, what the indirect codes mean, when to record it, how to fix a mistake, and who to ask when it is not obvious.
Do this instead: one short email at the start of the contract, and the same email to every new joiner. It is the cheapest item on this list and the one that decides how a floor check goes.
8. Thinking you are too small for it to matter
What it sounds like: “We are twelve people with one contract. This is for the big defense firms.”
The rules follow the contract type, not the headcount. DFARS 242.7503 prescribes the accounting system clause for cost-reimbursement, incentive, time-and-materials and labor-hour work and for progress payments based on cost, and it says nothing about how many people you employ. A twelve-person firm on a cost-reimbursement contract is held to the same standard as a large one.
What does change with size is how formal it needs to be. A small firm needs clear categories, daily entry, a named approver and a one-page written policy. It does not need a compliance department, and the whole setup is an afternoon.
This is the case TimeRewards is built for. One-click DCAA compliance sits on the entry tier rather than behind an enterprise plan, which means a twelve-person firm gets the same audit trail, approval routing and correction history as a large one. Our overview for government contractors covers what that looks like at this size.
Common questions
Fix it going forward rather than trying to rewrite history, and write down when the change happened and why. Retrospectively “correcting” months of timesheets to look tidy is worse than an honest gap, because it turns a record-keeping weakness into something that looks deliberate. Get the structure right from a clean date and keep the note.
Number three, reconstructing the week on Friday. It is the most common, it is the one a floor check exposes immediately, and it is the easiest to fix because it needs a habit rather than a project. Number seven is a close second for the same reason: an auditor talks to your staff, so what your staff know matters more than what your system does.
Care is not the constraint. A spreadsheet overwrites by design, so when somebody fixes a wrong project code the previous value is simply gone, along with who changed it and why. That history is exactly what mistake four is about. It is also why most contractors move to a timekeeping system after their first award rather than before their second.
The accounting system clause follows cost-reimbursement, incentive, T&M and labor-hour work, so a firm-fixed-price contract may not carry it. The habits still pay for themselves: job costing is how you find out whether the contract made money, and the standard arrives with your next award of a different type. Building the records from the start is what makes that transition uneventful.
An afternoon for the setup and one email for the training. Creating the projects, defining direct and indirect codes, naming who can charge what and who approves it, and switching on daily reminders is the bulk of it. The part that takes longer is the habit, and that is a fortnight of gentle nagging rather than a project.
Free · nothing to fill in
Score yourself against the eight
Tick the ones you can honestly say you already do. Anything left unticked is this week’s work.
0 of 8 confirmed
If you ticked six or more, you are in better shape than most first-time contractors and the rest is tidying. If you ticked two, that is worth knowing now rather than during a floor check, and none of it is hard. The full picture is in our DCAA timekeeping requirements guide and the wider DCAA compliance overview, the setup sequence is in what to do after a federal award, and there is a glossary for the terminology and a time card calculator if split weeks are still being added up by hand.
Fix all eight in an afternoon
Create your projects, split your direct and indirect codes, name your approvers and switch on daily reminders. After that every hour arrives with its author, its timestamp and its full history attached, and stays that way.
14-day free trial · No credit card required · One-click DCAA compliance on every plan
This article explains published federal acquisition and audit guidance in plain terms, with the sources linked. It is not legal or accounting advice. What applies to your contract depends on its terms and clauses, and your contracting officer and accountant are the people to confirm it with.