DCAA Work From Home: What Your Policy Needs to Say
DCAA’s audit guidance sets minimum internal controls for contractor work-at-home programs, and almost nobody writes about them. Your DCAA work from home policy has to cover five, and a floor check still happens when the employee is not in the building.
Your engineer works from home three days a week. Nothing about what they charge has changed. They are on the same contract, doing the same work, booking the same hours.
What changed is how anyone else can tell.
A DCAA work from home policy turns out to be a page of writing rather than a piece of software. Most people expect something else when somebody says DCAA.
The short version
- Remote work did not change the rules. It changed the evidence available to somebody checking them.
- DCAA’s audit guidance sets minimum controls for work-at-home programs. Five of them, and they are about management, not monitoring.
- The exposure is a missing written policy, not a missing tool. If remote labor is material and nothing is written down, that is a citable deficiency.
- Remote staff use the same timekeeping system as everyone else. Not a separate process, not a spreadsheet emailed in.
- Floor checks still happen. The auditor talks to the supervisor, then reaches the employee by phone or video.
What actually changed, and what did not
The timekeeping criteria in your contract say nothing about where somebody sits. What DCAA expects from a timesheet is the same whether the person filling it in is at a desk in your office or at their kitchen table.
What an office gives you, quietly and for free, is corroboration. Somebody saw them. Somebody knows roughly what they worked on. If an auditor walks the floor, there is a person to ask and a desk to find them at.
Take that away and the record has to carry the weight on its own. That is not a new obligation. It is the same obligation with less around it.
Which is why the manual’s answer is a written policy rather than a technology requirement. The policy is what replaces the thing the office used to supply.
Whether any of this applies to you yet
DCAA’s floor check audit programs tell auditors to assess whether your work-at-home labor is material. If it is, your policies and procedures get evaluated. If it is not, and nothing is written down, the auditor notifies you in writing that the requirement arrives when the costs do.
So there are two useful readings of that. The first is that a small amount of occasional remote work is not an emergency. The second is that “not yet” is the only thing being said, and the letter is a dated record that you were told.
The consequence, in the manual’s own words
Where work-at-home costs are material and “the contractor does not have adequate written policies and procedures, the contractor should be cited for a labor accounting system deficiency, usually under the Labor Authorization/Approval or Timekeeping control objectives.”
Source: DCAA Contract Audit Manual, 6-405.5, March 2021 edition, which DCAA’s current floor check audit programs still direct auditors to
What gets cited there is the absence of written policies, rather than the remote work itself or the software behind it. That puts it in an unusual category for an audit finding, because you close it by writing a page and then following it.
The five controls a DCAA work from home policy has to cover
These come from 6-405.5(b)(2) of that edition. In the manual’s own phrasing, they are less demanding than people expect.
| The control | What it means on a Tuesday |
|---|---|
| “Proper advance approval by appropriate management officials” | Somebody with authority agreed to the arrangement, before it started, in writing. An email thread counts. A shrug does not |
| “Continuing evaluation of the participating employee’s performance in completing assigned tasks” | Their work is being reviewed the way anybody else’s is. This is a management practice, not a surveillance one |
| “Written documentation of the specific tasks to be performed along with expected completion dates” | What they are meant to be doing, and by when, written down. This is also the evidence an auditor asks the supervisor for |
| Attending “periodic meetings at the contractor’s work site” | They come in sometimes, to discuss progress, get assigned work and have it evaluated. The manual does not set a frequency, so set one and keep it |
| Working “a mutually agreeable set of core hours to allow management to have access to the WAH employee at designated times” | Hours when they are reachable, agreed by both sides. Access for management, not a fixed shift |
Nothing in that list asks you to watch anybody. Every one of the five is about a manager knowing what somebody is working on and being able to reach them at agreed times. A supervisor should be doing that whether the person is in the building or not.
Timekeeping for people at home
Work-at-home employees “should be required to submit timecards in accordance with the company-wide timekeeping system”, and copies of those timecards should be kept at the company facility.
That rules out the workaround most small firms reach for when people start working from home, which is to let the remote half do it differently because it is easier. A spreadsheet emailed to a manager on Friday is a second process. A second process becomes a second standard. The seam between the two is where an audit tends to find something.
What this looks like in practice
The requirement is not a remote-specific feature. It is the ordinary one: everybody records their own time in the same system, against the same contract and indirect codes, with the same approval running behind it. Somebody at their kitchen table and somebody at a desk are the same record.
In TimeRewards that is the default rather than a configuration. Every hour lands against a named cost objective with its author, timestamp and full correction history attached, and approved time reaches accounting without anybody retyping it. One-click DCAA compliance is on every plan, including the entry tier, so a distributed team does not need an upgrade to be recorded the same way as everyone else.
What a floor check looks like when nobody is in the building
Floor checks did not stop. DCAA’s current audit programs tell auditors to floor check work-at-home employees by telephone or video, and the manual sets out the sequence.
The auditor interviews the supervisor
They are looking for evidence of the employee’s work, and for evidence of real supervisory control over the work-at-home schedule. This is where the written task documentation earns its keep.
Then they call the employee, by phone or video
To check the employee knows the work-at-home procedures, and to discuss what they are working on and which labor charge numbers they are using.
Anything unclear goes back to the supervisor
Questions get raised at the employee’s next scheduled meeting. Which is one more reason those periodic meetings are in the list of five.
The five controls map onto that sequence exactly. Advance approval, documented tasks, periodic meetings and agreed core hours are precisely what the auditor asks the supervisor about. The policy is less paperwork than a description of the evidence you will be asked to produce.
It also means the failure mode is familiar. A floor check goes badly when staff have never been told what they are supposed to be charging, and that is truer at distance, not less true.
Free · nothing to fill in
A DCAA work from home policy, in eight lines
Write these down and follow them, and you have the written policies the deficiency in the manual is about. An afternoon, once.
0 of 8 confirmed
If a contract has only just landed and none of this was on your radar, what to do after winning a federal contract is the wider sequence. Whether the strict clause reaches you at all depends on how you get paid. For the standard itself there is our DCAA compliance overview and the government contractors page, and any unfamiliar term is in the glossary.
Questions people actually ask
No. Nothing in the five controls asks for screenshots, keystroke logging, location tracking or a camera. They ask for advance approval, task documentation, performance review, periodic on-site meetings and agreed core hours when management can reach the person. Every one is a management practice. A vendor selling you surveillance to satisfy this is selling you something the manual does not ask for.
Probably not yet, and the manual handles this. Materiality is assessed first. If your work-at-home labor is not material and nothing is written down, the auditor notifies you in writing that the requirement arrives when the costs do. The notification is dated, which matters if remote work grows and somebody later asks when you knew. The policy is an afternoon, so most firms write it once the second person starts.
That is the workaround the requirement rules out. Work-at-home employees submit timecards in accordance with the company-wide timekeeping system, the same one everybody else uses. Running a second process for the remote half produces a second standard. The seam between two standards is where an audit finds something. It also breaks the approval separation, because an emailed sheet is a manager holding a document rather than a supervisor reviewing a record.
The point of it is retrievability: the records exist somewhere the company controls and can produce on request, rather than only on an individual’s machine. A system of record the company administers satisfies the intent. Being able to export and produce the relevant period on demand is the practical test. If you want certainty for your specific setup, that is a reasonable question for your contracting officer or your auditor, and asking it is cheaper than assuming.
Yes. DCAA’s current floor check audit programs tell auditors to check work-at-home employees by telephone or video conferencing. The manual’s sequence starts with the supervisor, who is interviewed for evidence of the work and of supervisory control over the schedule. Then the auditor calls the employee to check they know the procedures, and to discuss what they are working on and which charge numbers they are using. It goes fine when people know what they are charging and why, and badly when nobody ever told them, which is a ten-minute conversation you can have this week.
One system, wherever your people are
The policy is yours to write, and it is an afternoon. The other half, everybody recording in one system with the author, the timestamp and the correction history attached, is what TimeRewards does on every plan including the entry tier.