John Burr
General Manager, AutoTime Solutions Inc.
No software is DCAA-approved. The Defense Contract Audit Agency does not approve, certify, or recommend any software product, and it says so in its own contractor FAQ. DCAA auditors evaluate the contractor’s timekeeping system as a whole: the software, the written procedures behind it, and how employees and supervisors use both every day. Those records, controls, and daily practices are what an auditor tests, and they are the focus of DCAA timekeeping compliance for every contractor holding cost-reimbursable or time-and-materials work.
What does DCAA say about software?
Question 4 in DCAA’s contractor FAQ asks whether the agency recommends any commercial off-the-shelf accounting software. The answer is one line: DCAA “neither recommends nor approves” any specific vendor package.
The FAQ addresses accounting software, and timekeeping falls inside that scope. The Defense Federal Acquisition Regulation Supplement defines a contractor’s accounting system as its system or systems for accounting methods, procedures, and controls. DFARS 252.242-7006 then lists the criteria an acceptable accounting system must meet. Criterion (c)(9) is a timekeeping system that identifies employees’ labor by intermediate or final cost objectives, and criterion (c)(10) is a labor distribution system that charges direct and indirect labor to the appropriate cost objectives.
The same timekeeping criterion appears on Standard Form 1408, the checklist used in a pre-award survey of a prospective contractor’s accounting system. For a company bidding on its first cost-reimbursable contract, that form is often where an auditor first examines its timekeeping.
Who approves your timekeeping system, if not DCAA?
DCAA audits the system and reports its findings to the contracting officer, who makes the decision. Under DFARS 252.242-7006, the contracting officer determines whether to approve or disapprove a contractor’s accounting system after reviewing the auditor’s findings. When a contract includes DFARS 252.242-7005, Contractor Business Systems, a disapproved system can lead the contracting officer to withhold payments.
DCAA also does not issue fines. Its findings go to the contracting officer, and the Department of Justice handles cases involving false claims.
Two more points from the DCAA FAQ shape how contractors prepare. A contractor cannot request a DCAA audit of its own system, because the contracting officer initiates audits. DCAA auditors also cannot give a contractor specific advice on preparing its submissions, since that would impair their independence under Generally Accepted Government Auditing Standards. There is no pre-clearance step and no seal a contractor can obtain in advance, so the timekeeping system has to hold up on its own when the auditor arrives.
What do DCAA auditors evaluate instead?
Auditors test the controls that make labor records reliable. The table below lists the controls they look for and the common ways each one fails.
| Control | What an auditor looks for | Where it breaks down |
|---|---|---|
| Daily time entry | Hours recorded as the work happens | Timesheets reconstructed from memory at the end of the week, or filled in before the work occurs |
| Individual credentials | Each employee records their own time under their own login or badge | Shared logins, or a lead entering time for a whole crew |
| Charge code restrictions | Employees charge only to the contracts and tasks they are authorized to work | Hours charged based on remaining funding instead of the work performed |
| Documented corrections | The original entry is preserved, along with who changed it, when, and why | Entries overwritten with no history, or supervisor edits the employee never sees |
| Supervisor approval | A supervisor who knows the work reviews and approves each timesheet | Bulk approvals with no real review |
| Total Time Accounting | Every hour worked is recorded, including uncompensated overtime by exempt employees | Salaried staff recording 40 hours regardless of the hours they worked |
| Reconciliation | Recorded hours tie out to payroll and to labor distribution | Timekeeping and payroll totals that do not match |
"An auditor wants to know whether the hours on a timecard match the work the employee was doing that day. Every control in a timekeeping system exists to make that comparison hold up."
Floor checks test these controls in person. An auditor arrives unannounced, asks employees what they are working on, and compares their answers to the charge codes on their timecards. On a manufacturing floor, that comparison often happens at the terminal where employees clock in and select their job.
Does “DCAA-compliant” still mean something?
DCAA-compliant is an accurate term when it describes software built to support the DFARS timekeeping criteria. DCAA-approved implies a government endorsement, and no such endorsement exists.
Software does change how reliably the controls hold. A well-built system blocks charges to unauthorized codes, keeps the original entry when a timecard is corrected, and routes changes back to the employee for acknowledgment. Paper timecards and spreadsheets leave each of those controls to individual discipline, which makes them harder to demonstrate during an audit.
Software alone will not satisfy an auditor. The contractor still needs a written timekeeping policy, trained employees and supervisors, and consistent practice. DCAA evaluates how a system is configured and used, and a compliant product configured with weak controls can produce the same audit findings as a spreadsheet.
How do you vet a vendor’s compliance claims?
These six questions help distinguish software built for government contract labor from general time-tracking tools.
- What happens to the original entry when a timecard is corrected? The original should stay on record, along with who made the change, when, and the reason.
- Can a supervisor change an employee’s hours? If so, ask what record the change leaves and whether the employee has to acknowledge it.
- How are charge codes restricted? Employees should see only the contracts and tasks they are authorized to charge.
- How does the system capture uncompensated overtime? Total Time Accounting requires a record of every hour worked by exempt employees.
- How do hours reach payroll and the ERP? Ask how recorded hours reconcile with payroll and labor distribution, and which accounting systems the vendor integrates with.
- Have customers used the system through floor checks and accounting system audits? A vendor with government contractor customers should be able to describe that experience in detail.
Treat any vendor that describes its product as DCAA-approved or DCAA-certified with caution. The claim conflicts with DCAA’s own published position.
Frequently asked questions
Does DCAA certify timekeeping software?
No. DCAA's contractor FAQ states that the agency neither recommends nor approves any specific accounting software package. DCAA audits contractors' systems and practices.
Can I use spreadsheets for DCAA timekeeping?
DFARS does not require a specific tool. Spreadsheets make it difficult to show daily entry, individual accountability, and preserved corrections, which are the controls auditors test.
Who decides whether my accounting system is adequate?
The contracting officer makes the determination, using DCAA's audit findings.
Does buying compliant software make my company compliant?
No. Compliance depends on the software, the written procedures, and daily practice working together.
Building timekeeping that holds up in an audit
AutoTime Solutions builds timekeeping and labor tracking for aerospace, defense, and government contractors around the controls described above, and AutoTime customers have used the platform through DCAA floor checks and accounting system audits. To see where your current practices stand, take the DCAA Timekeeping Compliance Assessment, a 3-minute self-assessment that scores readiness across six areas.