Timesheet Approval Workflow: Project Manager First, Then Finance
A DCAA timesheet approval workflow needs one signature from the employee and one from the supervisor. Contractors route approvals through two people as they grow, and two separations of duty in DCAA’s guidance explain why.
A project manager and a finance lead can look at the same timesheet on the same Tuesday, and neither can answer the other’s question about it. That is why DCAA treats approval as a control rather than a formality.
The project manager knows whether the work happened. They were in the standup, they saw the pull request, they know Priya spent Tuesday on the integration and not on the proposal.
Finance knows whether those hours can be charged where they were charged. They know which contract is funded, which task order the work falls under, and which of your indirect pools the admin time belongs in.
One person can answer one of those questions well. Asking them to answer both is where approval quietly stops being a control.
The short version
- DCAA asks for two signatures on a timesheet, the employee’s and the supervisor’s, and it names them separately for a reason.
- A supervisor may not fill in somebody else’s timesheet, except for prolonged authorized leave.
- Two separations of duty sit behind the rule. Timekeeping apart from payroll, and time records apart from whoever owns the budget.
- Routing through a project manager and then finance is an operational design, not the audit minimum. It is what firms move to as those separations get harder to hold in one person.
- Delegation is where small teams actually break. One approver goes on leave at month end and everything stops, or somebody shares a login.
Why labor gets a control that other costs do not
Every other cost on a federal contract arrives with something outside your company attached to it. Materials have a purchase order and an invoice from a supplier. Travel has receipts. Subcontractors send bills you did not write.
Labor has none of that, and the audit manual says so directly.
Why the individual employee is the control
“Unlike other costs, labor is not supported by external documentation or physical evidence to provide an independent check or balance. The key link in any sound labor time charging system is the individual employee.”
Source: DCAAM 7641.90, Information for Contractors, Enclosure 3 · Read from the manual
An hour of somebody’s Tuesday exists only as an assertion by the person who worked it. Approval is the second assertion that makes the first one worth something. That is why the manual asks for both signatures rather than one.
What DCAA asks of a timesheet approval workflow
The requirement is item (8) of Enclosure 3. It is one sentence longer than most people expect. “Employees should sign their timesheet certifying that the hours on the timesheet reflect the hours worked and the appropriate cost objective at the end of each work period. The supervisor should approve and cosign all timesheets.”
Two roles, two acts. The employee certifies what they did. The supervisor confirms it and cosigns, which is a different verb from the one the employee performs.
Item (5) then closes the obvious loophole: “The supervisor should be prohibited from completing an employee’s timesheet unless the employee is absent for a prolonged period of time on some form of authorized leave.” A manager going round on Friday filling in the gaps produces a record of what a manager remembers being told, which is not the same thing as a record of what happened.
The manual names one supervisor rather than a chain of them, and a single approving supervisor satisfies the requirement. The pressure to add a second one comes from somewhere else. It builds as a company grows and the person closest to the work starts carrying the budget too.
The two separations most small firms have never been told about
DCAA’s guide for contractors and its floor check audit programs ask for the same two divisions of responsibility. Both are easy to fail without noticing.
| The separation | What it looks like when it is missing |
|---|---|
| Timekeeping apart from payroll. The people preparing time and attendance records are not the people preparing and distributing the payroll | One office manager does both, which is completely normal in a firm of twelve and is still the control weakness the guidance describes |
| Time records apart from budget owners. Information for Contractors is blunt: supervisors accountable for meeting contract budgets “should not have the opportunity to initiate employee time charges” | The person whose contract is running hot is the same person who can move an hour off it. Nobody has to act on that for it to be a finding |
The guidance is realistic about size. Information for Contractors recognizes that a very small company may not manage this kind of segregation, and says a larger company needs it. The budget separation is the one that tends to survive growth unnoticed, because a project manager who owns delivery usually owns the budget too.
That is the pressure that produces two-stage approval. Not a rule demanding it, but two separations that get harder to hold as the person approving the time becomes the person answerable for the number.
What a two-stage timesheet approval workflow buys
The project manager reviews first
They confirm the work happened and that it happened on what the timesheet says. This is the assertion only somebody close to the work can make.
Finance reviews second
They confirm the hours can be charged where they were charged: the contract is funded, the task order is right, the indirect codes are the ones your rate structure expects.
Neither of them edits the employee’s entry
A rejection goes back with a reason. The person who recorded the hour is the person who changes it. Item (6) wants the original charge, the corrected charge and the employee’s concurrence all retained.
The second stage is also where the budget separation gets its teeth. If the project manager owns the contract’s margin, finance reviewing after them means the person under cost pressure is not the last word on the number.
Where the product sits, precisely
One-click DCAA compliance is on every TimeRewards plan, including the $9.99 entry tier. Hours land against a named cost objective, corrections keep the original value with the author, timestamp and reason attached, and approved time reaches your books without anybody retyping it.
Approval routing is on every plan too. The two-stage version this post describes, where a project manager signs before finance does, is Multi-Level Timesheet Approval Workflow, on Professional and above. If you have reached the point where two people need to sign in sequence, that is the plan that does it.
Delegation, which is where small teams actually break
The failure is not dramatic. Your one approver takes two weeks off in September, and month end arrives. Forty timesheets sit unapproved while the accounting close waits on them.
What happens next is the problem. Somebody shares a login, or the approval gets done retrospectively in a batch of forty with no real review in any of them. Both of those are worse than the delay.
A delegation rule fixes it in three lines. Name who covers each approver. Say that the delegation is recorded rather than assumed. Keep the delegate’s own name on the approval. An approval that shows the absent person’s name is a record of something that did not happen.
A shared login fails that last test in a way nothing else in this article does. It does not produce a wrong record. It produces a record that cannot be checked at all. The same logic applies to a distributed team, where the temptation to hand credentials around is higher.
What the record has to show afterward
An auditor testing this is looking at the trail rather than the policy. DCAA’s floor check audit program tells auditors to find out whether all changes are properly initialed or approved by the employee and the designated approving supervisor. That is both names again, rather than one.
So the record needs to carry who submitted, who approved, when each happened, and what changed between the two. If a timesheet went out at eight hours and came back approved at seven, the trail has to show the original, the correction, and the employee agreeing to it.
That last part is the requirement spreadsheets cannot meet, because a spreadsheet overwrites by design and last month’s value is gone rather than superseded.
Free · nothing to fill in
Six questions about your approval process
Answerable in ten minutes, and they are the ones an auditor works through.
0 of 6 confirmed
If an award has just landed and none of this is set up yet, what to do after winning a federal contract covers the wider sequence. For the standard itself there is our DCAA compliance overview and the government contractors page. Any unfamiliar term is in the glossary, and the time card calculator will check hours by hand while you are setting things up.
Questions people actually ask
No. Enclosure 3 asks the employee to sign and the supervisor to approve and cosign, which is one approver. Two-stage routing is an operational design that makes the two separations of duty easier to hold. Firms usually adopt it when the person closest to the work is also answerable for the budget. If one supervisor approves your timesheets and the separations are intact, you meet the requirement.
Not automatically. Information for Contractors recognizes that a very small company may not manage this kind of segregation, and expects it of a larger one. Look hardest at the budget separation: supervisors accountable for meeting a contract budget should not have the opportunity to initiate time charges. If your one person also owns a contract’s margin, fix that half first, usually by changing who approves rather than by hiring.
Send it back instead. Item 6 wants a correction documented with the original charge, the corrected charge and documentation of the employee’s concurrence. A manager editing the cell produces none of those. It is also the fastest way to turn a small coding error into a question about who has been changing timesheets. That is a much worse conversation than the one about the error.
A named delegate, recorded in advance, approving under their own name. The two answers to avoid are a shared login, which makes the record uncheckable, and a batch of forty approvals done retrospectively, which is a review that did not really happen. Writing the delegation rule down takes about three lines and it is the thing most small teams have never done.
The trail rather than the policy document. DCAA’s floor check audit program has auditors check that changes are initialed or approved by both the employee and the designated approving supervisor. It also has them reconcile hours on time records against attendance and payroll records, and test both separations of duty. A policy that describes a process nobody follows is worse than no policy, because it documents the gap.
Approvals that hold up, on the plan that fits
One-click DCAA compliance and audit-ready correction history are on every plan. When a project manager and a finance lead need to sign in sequence, multi-level approval routing is on Professional.