DCAA Follow-Up Audits: Proving the Fix Actually Stuck
DCAA changed how it handles contractors that have already had a finding. For years, a single business system deficiency could pull the entire system back through a full re-audit. In 2026 the agency started running targeted follow-up audits instead, built to check one thing: did the corrective action hold?
That sounds like relief. It is not, unless you can prove it. A follow-up audit does not ask whether you filed a corrective action plan. It asks whether the fix is real and whether it has held up in daily practice. The evidence for that is your ongoing records, not a binder assembled the week before the auditor arrives.
What changed in 2026
DCAA introduced targeted follow-up audit programs for business systems, built to verify corrective actions and sustained compliance without re-performing entire system reviews. The programs apply to accounting systems, post-award accounting systems, estimating systems, and material management and accounting systems.
Historically, an identified deficiency often meant an extensive re-audit that disrupted operations and consumed resources on both sides. The new approach narrows that to focused validation, but with a condition attached. Contractors with prior findings can expect a targeted check rather than a full re-examination only when their corrective actions are well documented and effectively implemented. The agency also updated its audit reporting terminology to line up with generally accepted government auditing standards.
What a follow-up audit actually tests
It helps to walk the path a business system finding takes. Consider a mid-size contractor whose accounting system draws a material weakness during a routine audit.
The cognizant contracting officer issues an initial determination, the contractor has 30 days to respond in writing, and after the final determination the contractor has 45 days to correct the weakness or submit an acceptable corrective action plan with milestones.
If the system is disapproved and the contract carries the Contractor Business Systems clause, the withholding starts. The contracting officer withholds 5 percent of amounts due from progress payments and performance-based payments, and directs the same 5 percent withhold on interim vouchers for cost-reimbursement, labor-hour, and time-and-materials work. An acceptable corrective action plan that is being effectively implemented drops the withholding to 2 percent. Fail to follow that plan and it goes back up. The cap is 5 percent for one business system and 10 percent across multiple systems.
Put numbers on it. A contractor billing $600,000 a month in progress payments loses $30,000 a month at 5 percent. Over a six-month remediation, that is $180,000 sitting with the government instead of funding operations. The money is released once the system is re-approved, but the gap during remediation is real, and it lands hardest on the smaller firms with the least room in their cash flow.
The follow-up audit is the moment all of this gets tested. The contracting officer, usually with DCAA support, verifies that the corrections are in place in both policy and practice. If the corrective action was cosmetic, a failed verification resets the process and tells the contracting officer the fix was never real.
Filing a plan is not the same as fixing the system
This is where contractors get caught. A corrective action plan is a promise about the future. A follow-up audit tests the past few months of performance. Auditors re-interview employees, re-check whether the corrected procedures are actually being followed, and look for a clean operating history under the new process. If the only proof you can put on the table is the plan document and a revised policy, you cannot show that the fix held from one pay period to the next. What demonstrates that is a record of how the system has actually run since the finding: every entry, every correction, and the person and moment behind each one.
The exposure does not stop at the withholding
The withholding is the visible cost, and it is not the whole cost. A disapproval also restricts eligibility for new cost-reimbursable awards until the system is re-approved. And the 5 to 10 percent is a floor, not a ceiling. The same weaknesses that trigger a system finding can feed larger claims: defective pricing demands, repayment of unallowable costs, and in the worst case False Claims Act exposure. A control weakness that lets costs land in the wrong place is the same weakness a fraud theory is built on. The system finding and the larger claim are two views of one underlying problem.
The trigger is wider than many firms assume
Many contractors assume fixed-price work keeps them clear of the business system rules. It does not. The accounting system clause reaches any contract with progress payments based on costs incurred or a percentage or stage of completion, and DCAA’s 2026 posture is expanding scrutiny into fixed-price arrangements with cost-based progress payments. If you bill that way, these rules apply to you.
What makes a follow-up audit a non-event
The contractors who move through a follow-up audit without drama are the ones whose systems produce the evidence on their own. Time and cost captured as the work happens. A complete, tamper-evident audit trail that shows every entry and every correction, with the person who made it and the moment they did. Charge-code access limited to what each employee is authorized to work. Supervisor certification that verifies before it approves. A sustained operating history that speaks for itself.
That is the difference between preparing for a follow-up audit and simply being ready for one.
AutoTime builds that evidentiary discipline into daily timekeeping and labor tracking for aerospace and defense contractors, so the record a follow-up audit asks for is already in place before the auditor arrives. If you want a read on where your current process stands, the DCAA Timekeeping Compliance Assessment scores your readiness across six areas in about three minutes.