DCAA vs FAR: Who Writes the Rules and Who Checks Them

The FAR writes the rules. DCAA checks your records against them, and a contracting officer decides what the findings mean for your contract. Nobody at DCAA certifies a company or approves a product. DCAA compliant is shorthand for a system that satisfies the clauses your own contract carries.

This guide follows those pieces in order: the regulation, its defense supplement, the auditor, and the official who decides. It then covers the Cost Accounting Standards thresholds that rose this year, and the FAR overhaul now running beside the codified text. Everything here is read from the FAR, DFARS, the Cost Accounting Standards regulations and DCAA’s own manual for contractors.

The question usually arrives on paper. A prime contractor sends a questionnaire, and one line asks whether your timekeeping is DCAA compliant. You tick yes, then go looking for DCAA’s rules to be sure. What you find is a regulation written by somebody else, a manual written for auditors, and a guide telling contractors what those auditors will look for.

That search is the DCAA vs FAR question in miniature. Knowing who holds which piece tells you where to look when a requirement matters. It also shows what your timekeeping policy has to do, because that is the one piece nobody writes for you.

DCAA vs FAR: which one actually sets the rules?

The FAR does. It is the single acquisition regulation for executive agencies. The FAR Council prepares and issues it jointly, under the several statutory authorities of its members. Those members are the Administrator for Federal Procurement Policy, the Secretary of Defense, the Administrator of General Services, and the Administrator of NASA.

The regulation is not the whole system. Both the codified FAR and the overhaul text describe it as the FAR plus the agency regulations that implement or supplement it. The Defense Federal Acquisition Regulation Supplement, DFARS, is the Defense Department’s. Most of what defense contractors call DCAA requirements lives there or in the FAR itself.

DCAA publishes guidance rather than regulations. Its Contract Audit Manual tells auditors how to test, its Directory of Audit Programs sets out the steps for each kind of audit, and its manual for contractors explains what those auditors will look for. Every requirement being tested comes from the regulations and from your contract.

Knowing which part of the FAR to open is half the work. The regulation is organized by subject rather than by audience. Five parts carry almost everything a contractor’s finance team deals with.

So the questionnaire line is asking about a system rather than a certificate. Which pieces of that system get tested depends on the contract it was asked about.

Which parts of the FAR reach your timesheets?

Only the parts your contract brings in. The FAR is long, and a timesheet meets a few pieces of it, mostly through the clauses your contract carries.

The first is the cost principles in Part 31. They apply to pricing whenever cost analysis is performed, and to the determination, negotiation or allowance of costs when a contract clause requires it. Labor is caught because labor is a cost.

Part 31 then sets out what makes any cost allowable. A cost qualifies only when it meets all five of the requirements below. A labor cost meets them through the timesheet behind it.

Reasonableness carries a rule about proof that surprises people. No presumption of reasonableness attaches to a cost simply because you incurred it. Once the contracting officer or their representative challenges a specific cost, the burden of proof is yours. For a labor cost, the evidence is the record of who worked the hours and on what.

The section on supporting records ends on the consequence, in words identical in both versions of the FAR.

That section is frequently quoted as a timekeeping rule, and it is not one. It never mentions hours, timesheets or recording frequency. It requires records adequate to demonstrate that a claimed cost was incurred, is allocable to the contract and follows the cost principles. For labor, that means the timesheet.

The second piece is the Audit and Records clause at FAR 52.215-2. On cost-reimbursement, incentive, time-and-materials, labor-hour and price redeterminable contracts, you maintain records that properly reflect the costs you claim, and the contracting officer or an authorized representative may examine and audit them. Normally, that representative is DCAA.

The third arrives before the contract does. FAR 16.301-3 allows a cost-reimbursement contract only where the contracting officer finds your accounting system adequate for determining the costs of that contract. A preaward accounting system survey is usually how that gets established. It looks at the design of the system rather than a year of transactions.

The fourth shows up at the end of the year. FAR 52.216-7, Allowable Cost and Payment, governs reimbursement on cost-reimbursement work and requires an annual proposal for final indirect cost rates. The hours recorded all year are what that proposal is built from. So the incurred cost submission is a timekeeping problem as much as an accounting one.

Which clauses you carry depends mostly on contract type. Our guide to whether your contract needs DCAA-compliant timekeeping takes each type in turn.

What does DFARS add for defense contracts?

The accounting system clause, which is where most of the familiar DCAA language comes from. This is also where DCAA vs FAR gets muddled in conversation, because the clause everyone calls a DCAA requirement is a DFARS one. DFARS 242.7503 puts the clause at 252.242-7006 into solicitations and contracts that contemplate cost-reimbursement, incentive, time-and-materials or labor-hour work. It reaches contracts with progress payments too, where those payments are based on costs or on a percentage or stage of completion.

DoD contracts written since March 2026 carry the same clause as 252.242-7999 under a class deviation. The two texts were compared word for word: the criteria, the definitions and the process are identical, and only the cross-references change.

The clause defines what it is asking for. An acceptable accounting system is one that gives reasonable assurance on four points. Applicable laws and regulations are complied with. The accounting system and cost data are reliable. The risk of misallocations and mischarges is minimized, and contract allocations and charges are consistent with billing procedures.

It then lists 18 criteria the system has to provide for. Two govern timesheets directly, and several more reach the same records from another side.

Read as a set, the criteria describe a chain. Hours are recorded against a cost objective, distributed to direct and indirect accounts, posted at least monthly, cleaned of unallowable amounts, and billed in a way that reconciles back to the cost accounts. A timesheet that names the wrong cost objective breaks the chain at the first link. DCAA timekeeping requirements takes the timekeeping criteria one at a time.

If the contract also carries the business systems clause, the stakes rise. A final determination disapproving a system triggers a withholding of five percent of amounts due on progress payments, performance-based payments and interim vouchers. Where several systems carry material weaknesses, the total reaches ten percent. Submit a corrective action plan the contracting officer accepts and implement it, and the withholding drops to two percent.

What is DCAA, and what does it actually do?

This is the checking half of DCAA vs FAR. DCAA is the Defense Contract Audit Agency, which sits inside the Defense Department under the Comptroller. Its job is auditing contractors and advising the officials who buy from them, not writing rules for them. In its 2025 financial year it examined $788 billion in costs and reported $18.8 billion in net savings.

The FAR describes the same job from the government’s side. The auditor analyzes contractor records, advises on whether incurred and estimated costs are acceptable, and reviews the financial and accounting aspects of a contractor’s cost control systems.

The FAR also names who normally does that work. DCAA is the responsible government audit agency in the normal case, and not only on defense contracts. Another agency can take on a particular contractor by agreement between the two. Nonprofits and universities are the exception, with their audit arrangements set under the Uniform Guidance at 2 CFR 200.

In practice the work arrives in five recognizable shapes, and each one asks your labor records a different question.

The floorcheck is the one employees notice. DCAA performs unannounced floor checks at contractors working under cost-reimbursable, time-and-materials and labor-hour contracts, to test timekeeping controls and the reliability of employee time records. The auditor is establishing three things. The employee is actually at work, and is working in their assigned job classification. Their time is charged to the right job or indirect account. Floorchecks happen in person where possible, and by telephone or video for people who work elsewhere.

One thing DCAA does touch directly is money on an interim voucher. Under DFARS, DCAA issues Forms 1, the Notice of Contract Costs Suspended and/or Disapproved, to deduct costs where allowability is questionable. The administrative contracting officer may also issue one, or direct that it be issued. The wider judgment on your contract still belongs to the contracting officer.

Who decides whether your accounting system is acceptable?

The contracting officer. DFARS puts the decision with the cognizant contracting officer, who consults the auditor or a functional specialist. That officer determines whether the accounting system is acceptable, approves or disapproves it, and pursues correction of any weakness.

The clause sets out the sequence, and the dates in it are worth diarizing before you ever need them.

1. The auditor reports

   DCAA puts its findings and recommendations in a report to the contracting officer, describing any material weakness in enough detail for you to understand it. A material weakness is a deficiency serious enough that a material misstatement might not be caught in time.

2. An initial determination, in writing

   The contracting officer issues a written initial determination identifying the material weaknesses, with the underlying deficiency described in enough detail to be understood.

3. You have 30 days to answer

   You respond in writing within 30 days. Disagreeing is allowed, provided you state your rationale, and this is where your own records do the arguing for you.

4. A final determination follows

   The contracting officer evaluates your response and issues a final determination. It covers any remaining weaknesses, the adequacy of proposed or completed corrective action, and disapproval of the system where weaknesses remain.

5. Then 45 days, and possibly withholding

   Within 45 days of a final determination you either correct the weaknesses or submit an acceptable corrective action plan with milestones. Where the contract carries the business systems clause, disapproval brings the payment withholding with it.

   The withholding is five percent of amounts due for one system, and up to ten percent across several. It drops to two percent once the contracting officer accepts your corrective action plan and sees you implementing it.

The division of labor is consistent all the way through. DCAA gathers evidence and recommends; the contracting officer acts.

So DCAA compliant, in practice, means acceptable to a contracting officer on the strength of DCAA’s evidence. That matters most when you disagree with a finding, because your response feeds a determination somebody else makes. It is read beside the records you kept at the time.

Where do Cost Accounting Standards fit?

Outside the DCAA vs FAR pairing altogether, with an author of their own. The Cost Accounting Standards Board writes the standards, chaired by the Administrator for Federal Procurement Policy, and the 2026 defense authorization act moved the Board into the Office of Management and Budget. FAR Part 30 is how the standards reach a contract.

Most contractors never come under them. The exemptions are listed in the CAS regulations themselves, and the first two catch the majority of companies reading this.

The thresholds in that list moved this year, and by a lot.

The order of events explains why two contractors can describe the rules differently and both be right. Congress set the new figures in the defense authorization act for 2026. The Defense Department began applying them to its own contracts by class deviation in July 2026. The Board’s rule applies them across the government from 1 October 2026.

Indefinite delivery contracts get their own treatment. On a multiple-award contract, the exemptions are tested at the award of each individual task or delivery order, against that order’s ceiling value. On a single-award contract, the test happens once, at award, against the contract’s ceiling.

Above the exemption line, coverage comes in two strengths. Modified coverage applies four standards, and full coverage applies all of them and adds a Disclosure Statement describing your practices in writing.

The first two are why timekeeping matters under CAS at all. If you estimate labor one way and record it another, the inconsistency is the finding. A contractor pushed into full coverage only by the old $50 million threshold can move affected contracts down to modified coverage. That happens at the start of its next full cost accounting period, and it takes a clean record on CAS noncompliances and a business unit below the new figure.

The Board expected the change to leave about 60 percent fewer covered business segments while keeping over 90 percent of covered dollars. So the standards now concentrate on large contractors. The defense accounting system criteria carry on regardless: practices follow the standards where they apply, and generally accepted accounting principles where they do not. A timesheet reads the same either way.

What does DCAA compliant actually mean?

It is shorthand rather than a defined term. It describes an accounting and timekeeping system that meets the criteria your contracts carry and runs the way DCAA’s guidance describes. Its records hold up when an auditor tests them.

On timekeeping, DCAA’s manual for contractors is specific about what it expects. These are the points its own guidance sets out, and they are the ones a floorcheck goes looking for.

DCAA’s audit programs turn those expectations into tests. On a floorcheck the auditor checks that changes are initialed and approved by the employee and the approving supervisor. Hours have to reconcile periodically with attendance and payroll records. The people preparing time records should also sit apart from those preparing the payroll and those operating within the budgets.

The label belongs to your system as a whole, and no product can hold it for you. DCAA’s contractor FAQ is direct about that: “DCAA neither recommends nor approves any specific accounting system vendor software packages.” What software decides is whether the correct entry is the easy one. TimeRewards puts daily entry against named cost objectives, a complete audit trail and recorded approvals on every plan.

Where does your timekeeping policy fit?

Your policy is the part of DCAA vs FAR that belongs to you, and it turns everything above into what happens on an ordinary Tuesday. The regulations say what a system has to achieve, and the auditor tests whether it does. Your timekeeping policy tells your people what to do so that it does. It is also the document an auditor asks for first.

Unlike materials or travel, labor has no invoice behind it and no external document to check it against. The employee’s own entry is the primary evidence. A policy written for employees therefore does more for you in an audit than one written for auditors.

A policy that holds up covers the daily rhythm and the exceptions. It sets out that time is recorded daily and charged by the nature of the work. Corrections follow a stated route, and timesheets are signed and approved. Every hour worked is recorded, paid or not. Solicitations above the simplified acquisition threshold carry FAR 52.237-10 on uncompensated overtime. So the unpaid hours have a home in the regulation too.

It also has to cover the people you cannot see. Remote and hybrid staff need the same controls, with advance approval, documented tasks and timecards submitted through the company-wide system, which is what a DCAA work from home policy spells out. Auditors run floorchecks on those employees by telephone or video, so the record has to stand on its own.

Does the FAR overhaul change any of this?

Not for the records your timesheets produce. The FAR overhaul is rewriting the regulation part by part in plainer language, and it works in an unusual order. The FAR Council publishes model text for a part, agencies adopt it by class deviation, and formal rulemaking follows afterwards.

That means two versions of some parts are live at once. The codified FAR still stands, while contracts from agencies that adopted the new text follow that instead.

None of the proposed rules so far covers Parts 30, 31, 42 or 52, which are the parts this article cites. For those, the deviation text is the only rewritten version in circulation, and the substance has held.

So the DCAA vs FAR roles hold in both versions, and so does what matters for a timesheet. The practical rule is to read each clause as it appears in your own contract. The number and date printed there are the ones that apply to you.

What should you check this month?

Pick your largest government contract, because the DCAA vs FAR question gets concrete once you read its clauses rather than its statement of work. An hour with one contract tells you more than a week of reading the regulation.

Start with the clause list. Look for FAR 52.215-2 and check whether its cost examination paragraph reaches your contract type. Look for the DFARS accounting system clause under either number, and for the business systems clause beside it. That pairing is what turns a finding into withheld payments.

Then test the award against the CAS thresholds. A negotiated contract of $35 million or less is exempt, and a small business is exempt whatever the value. Most readers can close that question in a minute.

Next, name the people. Who is your contracting officer, and which DCAA office audits your company? Find out before an audit notice makes the question urgent, and note who covers each of them.

Last, read your timekeeping policy beside DCAA’s guide for contractors. Anything the guide expects that your policy leaves unsaid is the first gap to close. The second is anything your policy says that your system does not enforce.

Unfamiliar terms are defined in the glossary, and the employee cost calculator shows what a labor hour really costs before an auditor asks. Our DCAA compliance overview covers the wider standard, the page for government contractors shows how the pieces fit together, and government contract management software takes the administration side in full.

Questions people actually ask