DCAA Compliance and Time Tracking

If your organization holds a cost-reimbursable, time-and-materials, or incentive contract with the Department of Defense, DCAA compliance sets the rules for how you track and prove every labor hour billed to that contract.

This article covers what those timekeeping requirements look like in practice, where they get hardest to meet for organizations with shift-based or multi-site workforces, and what auditors flag most often.

Falling short can mean rejected invoices, suspended payments, or contract termination. In more serious cases, civil penalties, debarment, or suspension from future federal work are the consequences of DCAA non-compliance.

What is DCAA compliance, and who has to follow it?

DCAA compliance means your accounting and time tracking practices satisfy the Defense Contract Audit Agency’s standards for federal contractors, primarily the Federal Acquisition Regulation (FAR), Cost Accounting Standards (CAS), and the DCAA Contract Audit Manual (CAM).

DCAA doesn’t certify a contractor as “compliant.” It audits on behalf of contracting officers across the Department of Defense and other federal agencies, and as of 2025 it oversees roughly 9,000 contractors and issues nearly 10,000 audit products a year, examining hundreds of billions of dollars in contract costs (DCAA, 2025).

It applies if you hold cost-reimbursable, time-and-materials (T&M), or certain incentive contracts with the Department of Defense or another federal agency that DCAA audits on its behalf. Here’s how the main contract types break down:

Cost-reimbursable contracts – The government covers your actual expenses rather than paying a flat rate. DCAA compliance is required — auditors verify how labor costs are calculated.
Time-and-materials (T&M) contracts – T&M contracts combine hourly billing with fixed material costs. These often attract additional DCAA scrutiny because billing is directly tied to calculated hours worked, which creates risk of inflated labor charges.
Subcontractors under prime federal contractors – Even if you’re not contracting directly with the government, DCAA rules may apply. If the prime contractor is required to follow them, that oversight often extends to subs.
Grantees, cooperative agreements, and research institutions – Universities, labs, and nonprofits receiving federal funding may also be subject to DCAA audits, especially when funding involves labor reimbursement.

Firm-fixed-price work has lighter requirements, but most federal contractors will face DCAA scrutiny at some point — during a pre-award accounting system review (SF1408), an incurred cost audit, or a routine floor check. If you’re charging hours to federal funds, assume the requirements apply.

Types of DCAA audits

DCAA groups its reviews into a handful of audit types, and knowing which one you’re facing shapes how you prepare.

Pre-award accounting system reviews (SF 1408) – Conducted before a cost-reimbursable contract is awarded, to confirm your accounting and timekeeping system can properly track and segregate costs.
Incurred cost audits – The most common audit type, reviewing actual costs billed against a contract after the fact, including labor hours and job code allocation.
Forward pricing audits – Reviews cost estimates and proposed labor rates before a contract is priced or modified.
Timekeeping audits and floor checks – Unannounced visits where auditors interview employees and compare their answers to what’s charged on the timesheet.
Special audits – Narrower reviews triggered by a specific concern, such as a whistleblower complaint or an unusual billing pattern.

Timekeeping audits and floor checks are the ones your time tracking system feeds most directly, which is why the requirements below matter as much as the accounting side.

DCAA timekeeping requirements at a glance

Use the table below as your DCAA compliance checklist — each one is covered in detail below.

Requirement	What it means
Daily time entry	Employees log hours each workday — not weekly, not in batches
Individual attribution	Employees record their own time; supervisors don’t fill in timesheets on their behalf
Project-level labor coding	Every hour is tied to a specific job code, contract, or cost objective — not a generic label
Total time accounting	Every hour worked is captured, including hours not billed to a federal contract
Direct vs. indirect labor	Billable and non-billable hours are clearly separated
Employee certification	Employees sign off on their own timesheets before submission
Supervisor approval	A manager reviews and approves timesheets before they go to payroll
Documented edit trail	Any change to a timesheet is logged with who made it, when, and why
Locked records	Approved timesheets can’t be changed without reopening the full approval process
Role-based access	Employees see and edit only their own time; admin access is limited and logged
Records retention	Timekeeping records are retained for a minimum of three years after contract end

DCAA compliance timekeeping requirements: what each one means in practice

DCAA’s timekeeping expectations are outlined in the DCAA Contract Audit Manual (DCAA-PAS-7641.90) and related FAR guidance. If you don’t want to read through 105 pages, here’s what each requirement looks like in a frontline environment.

Daily time entry

Employees record their hours each workday, at or near the time the work is performed — waiting until Friday afternoon to log a full week, or reconstructing hours after the fact, is one of the most common audit findings. For shift workers, this means punching in and out in real time, not summarizing at the end of a shift rotation.

Individual attribution

Supervisors can’t fill in timesheets on an employee’s behalf, even with good intentions, because every worker is supposed to record their own time. In a frontline environment, this means every worker (not just desk-based staff) needs a way to log their own hours in an employee time clock, whether through a biometric clock, badge reader, mobile app, or web portal.

Project-level labor coding

Generic entries like “maintenance work” or “security” aren’t sufficient. Every hour needs a specific job code, contract number, or cost objective attached to it. For frontline workers who move between job codes within a shift, the system needs to support mid-shift job code transfers.

Example: A maintenance crew servicing equipment funded by three different appropriations in a single morning.

Total time accounting

Every hour an employee works gets captured, not only the hours billed to a federal contract. That total-time view stops labor from being shifted between contracts to absorb cost overruns, which is a fraud risk DCAA audits are built to catch.

Direct vs. indirect labor

Your job code structure should make the split automatic at the point of punch, clearly separating billable hours (direct labor charged to a contract) from non-billable hours (overhead, general and administrative, fringe, training).

Employee certification and supervisor approval

Employees review and certify their own timesheets before submission, typically by approving, checking a box, or entering a PIN in a digital system. Supervisors then review and approve each timesheet before it’s finalized and sent to payroll. Both steps need to be logged.

Documented edit trail

If a timesheet is changed after submission, the system records the original value, the new value, who made the change, when, and why. Auditors look specifically for patterns of after-the-fact corrections. Edits documented with reasons and approved by supervisors are treated as routine activity. Undocumented changes are a red flag.

Locked records and role-based access

Approved timesheets can’t be altered without formally reopening the approval process. Employees access only their own time data. Admin access is limited by role and logged. These controls prevent unauthorized changes and protect the integrity of the audit trail.

Records retention

Timekeeping records must be retained for a minimum of three years after contract end, though some contract terms require longer. These records include entries, edits, approvals, and audit logs, which means your system needs to store complete records, not just summary data.

Common DCAA compliance audit flags to avoid

The stakes behind these flags are real. Beyond a rejected invoice, a DCAA referral can lead to:

Civil penalties, including treble damages under the False Claims Act
Criminal penalties for knowing or willful mischarging
Contract termination or suspension of payments
Debarment from bidding on future federal work

When a timekeeping practice doesn’t meet DCAA standards, it usually fails in predictable ways. These are the issues most likely to draw scrutiny during a floor check or incurred cost audit:

Time entered late or in bulk – Timesheets filled out days after the fact — or an entire week logged on Friday afternoon — are a primary audit finding.
Missing or vague project codes – Entries labeled “general work,” “admin,” or “miscellaneous” don’t meet the specificity DCAA requires.
No employee certification – Timesheets must be signed off by the person who worked the hours. Supervisor approval alone isn’t sufficient.
Supervisor approval missing – Without a documented management review, the timesheet is considered incomplete.
Undocumented edits – If entries change after submission with no log of who made the change or why, that’s a compliance finding.
No separation of direct and indirect labor – Hours not clearly categorized as billable or non-billable create cost allocation questions.
Inconsistent timesheet formats – Irregular formats, skipped fields, or manual corrections without documentation are harder to audit and more likely to be rejected.

If you’re unsure where your current practices stand, run them against the checklist above. Or better, use a system that enforces these standards automatically at the point of time entry.

Why DCAA compliance time tracking is harder for frontline teams

DCAA’s timekeeping model was largely built with knowledge workers in mind, like an engineer at a workstation, with a timesheet on the screen and project codes a click away. For frontline contractors, the same rules collide with the reality of daily operations:

Production workers may move between job codes several times in a shift
Security officers rotate posts that map to different contracts
Maintenance crews on a base may service equipment funded by three different appropriations in a single morning
Field technicians work nights and weekends, with shift differentials that have to be allocated correctly between direct and indirect labor pools

A timesheet model that assumes one person, one project, one workday breaks down quickly.

What frontline contractors need is time tracking software that accurately captures labor allocation at the point of work — on a clock, a tablet, or a mobile device — without slowing the shift or requiring supervisors to fill in what employees should be entering themselves.

How to prepare for DCAA audits before they happen

You don’t need to scramble when an audit is announced. The teams that pass build habits smoothly long before an auditor walks in. Focus on a few high-impact actions that keep your records clean and your people confident.

Three things make both DCAA audits and floor checks go more smoothly.

1. Start at the top

First, train your frontline supervisors. Most floor check findings come from employees who can’t articulate which code they’re charging or why — not from software gaps.

2. Trial run scenarios

Second, run mock floor checks before the real one. Pull the report your system generates, walk the floor, and see if reality matches the data.

3. Tidy up the house

Third, keep your edit trail clean. Auditors look for patterns of undocumented corrections. Edits with reasons, reviewed by supervisors, read as normal business activity.

How TimeClock Plus supports DCAA compliance on the frontline

TimeClock Plus works in the time tracking layer of a DCAA-compliant environment.

At the point of work — a biometric clock, badge reader, tablet, or mobile device — it captures, allocates, and audits labor data, then hands that data off to the accounting solution that books costs against contracts.

Here’s how the major DCAA requirements map to TimeClock Plus capabilities:

DCAA requirement	How TimeClock Plus supports it
Employees record their own time	Biometric, badge, mobile, and web clock options, with every punch attributed to the individual
Daily time entry	Real-time clock-in and clock-out, date- and time-stamped at the point of action
Total time accounting	All worked hours captured, including hours not billed to a contract
Project-level labor coding	Job codes and cost codes are selected at clock-in, with mid-shift transfers between codes
Direct vs. indirect labor	Configurable code structures that separate direct project labor from indirect categories
Documented edit trail	Full edit history capturing user, timestamp, original value, new value, and reason
Employee certification	Approval workflows that require employee acknowledgment before submission
Supervisor approval	Multi-level approval chains, exception flagging, and audit-ready reports
Locked records	Timesheets lock after approval; reopening requires a documented process with supervisor authorization
Role-based access	Configurable permissions by role — employees access their own time; admin access is scoped and logged
Floor check support	On-demand reports showing who’s clocked in, where, and on what code, all available in real time
Records retention	Complete audit logs retained and exportable in audit-ready formats for the full retention period

The combination matters most for organizations running shift work across multiple sites.

This might look like a base operations contractor with maintenance, security, and food service teams charging different contracts from the same facility. They need a solution that handles mid-shift code transfers, multiple clock types, and supervisor approvals across locations, not a desktop timesheet model.

Where TimeClock Plus fits in your DCAA compliance stack

Think of TimeClock Plus not as the replacement for your federal accounting solution, but the labor data layer that feeds it.

Your accounting solution handles indirect cost pools, contract billing, and incurred cost submissions. TimeClock Plus handles the part that the accounting solution can’t see — what your employees were actually doing, when, and where — captured at the point of work and ready to be passed downstream.

For federal contractors with significant frontline populations, the distinction matters. You can’t run a base operations contract from a desktop timesheet, and you can’t defend one without a complete record of every shift worked and every code charged.

Frequently asked questions about DCAA compliance

What is DCAA compliance time tracking?

DCAA compliance time tracking is the practice of capturing, attributing, and approving employee labor hours in accordance with Defense Contract Audit Agency standards. It includes daily entry, individual attribution, total time accounting, code-level labor allocation, documented edits, employee certification, supervisor approval, and a complete audit trail. And applied consistently across every employee whose hours are billed to a federal contract.

Is TimeClock Plus DCAA approved?

DCAA does not formally approve or certify time tracking software. DCAA evaluates a contractor’s overall accounting and time tracking practices, of which software is one component. TimeClock Plus is built to support the practices DCAA expects: daily time entry, individual attribution, audit trails, total time accounting, job code labor allocation, approval workflows, and locked records after sign-off.

What is a DCAA floor check?

A DCAA floor check is an unannounced visit by an auditor who verifies that employees are working on the contract for which their time is being charged. Auditors interview employees, review timesheets in real time, and compare actual work to the labor codes charged . Floor checks test both your timekeeping practices and whether your frontline employees can articulate what they’re billing.

What triggers a DCAA audit?

Audits can be triggered by inconsistent billing, timesheet inaccuracies, unusual overtime patterns, contractor performance concerns, or random spot checks as part of broader agency oversight. Contract renewals can also prompt a closer review of prior billing. Organizations on cost-reimbursable or T&M contracts should treat audits as routine, not a rare event.

Does DCAA require daily timekeeping?

Yes. DCAA expects employees to record their time daily, at or near the time the work is performed. Weekly or after-the-fact entries are among the most common audit findings and clearest signals of a non-compliant timekeeping practice.

What is total time accounting?

Total time accounting means every hour an employee works is captured, not just the hours billed to a federal contract. The practice prevents hours from being shifted between contracts to absorb cost overruns, which is a form of labor mischarging that DCAA audits are specifically designed to detect.

Can supervisors edit employee timesheets?

Supervisors can correct timesheets, but every edit must be documented with the original value, the new value, who made the change, when, and why. Employees should be notified of edits to their records and re-certify when changes are material.

What’s the difference between DCAA and FAR compliance?

The Federal Acquisition Regulation (FAR) is the body of rules governing federal procurement. DCAA is the agency that audits defense and certain other federal contractors for compliance with FAR, Cost Accounting Standards, and contract terms. FAR sets the rules; DCAA checks the work.

What’s the difference between DCAA and DCMA?

DCAA audits contractor costs, accounting practices, and incurred cost claims. DCMA, the Defense Contract Management Agency, handles contract administration instead — contractor performance, delivery schedules, and property management. Some federal contracts fall under both agencies’ oversight at once, so it’s worth confirming which one is asking before you respond to a request.

How long do federal contractors need to retain timekeeping records?

At a minimum, three years after contract end. Some contract terms and applicable FAR clauses require longer retention periods. Your timekeeping system needs to retain complete records, such as entries, edits, approvals, and audit logs. Not just summary data.

Next steps for DCAA compliance

DCAA timekeeping requirements aren’t going away. For federal contractors with frontline workforces, the gap between what the rules require and what manual or general-purpose time tracking can actually deliver is where compliance risk concentrates.

What you may consider basic administrative formalities — daily time entry, individual attribution, job code accuracy, documented edits, locked records, a complete audit trail — are what stand between your agency and a rejected invoice, a suspended payment, or a failed floor check.

When you have a time tracking solution in place like TimeClock Plus, compliance becomes a byproduct of how your team works every day, not a separate effort that kicks in when an auditor shows up.

Legal Disclaimer

The information is provided by TCP Software for general informational purposes only. It doesn't constitute legal advice, and no attorney-client relationship is formed through the use of this website or reliance on its content. 

TCP makes no representations or warranties about the accuracy, completeness, or timeliness of the information provided, and laws and regulations vary by jurisdiction and change frequently. Visitors shouldn't act, or refrain from acting, based on any information on this website without first seeking advice from a qualified attorney licensed in the relevant jurisdiction. 

Use of this information doesn't create a professional relationship between the reader and TCP or its employees, agents, or affiliates. TCP disclaims all liability for actions taken or not taken based on the content.

TCP Software’s employee scheduling and time and attendance solutions have the flexibility and scalability to suit your business and your employees, now and as you grow.

From TimeClock Plus, which automates even the most complex payroll calculations and leave management requests, to Humanity Schedule for dynamic employee scheduling that saves you time and money, we have everything you need to meet your organization’s needs, no matter how unique. Plus, with Aladtec, we offer 24/7 public safety scheduling solutions for your hometown heroes.

Ready to learn how TCP Software takes the pain out of employee scheduling and time tracking? Speak with an expert today.

How DCAA Compliance and Time Tracking Work Together