Skip to main content
Back to Resources

Business Operations

DCAA Compliance for Small Defense Contractors

What "DCAA compliant" actually means, the SF 1408 criteria, and how small businesses build compliant accounting without bankrupting themselves.

Core Requirements (SF 1408)

Segregation of direct and indirect costs in the general ledger.

Identification and exclusion of FAR Part 31 unallowable costs from indirect pools.

Cost accumulation by contract, task order, and CLIN.

Logical, consistent indirect rate allocation methodology (Fringe, Overhead, G&A).

DCAA-compliant timekeeping: daily entry, total time accounting, charge codes, approval trail.

The Three Audits You'll See

Pre-Award Survey (SF 1408): can the system accumulate costs correctly? You're judged on design, not history.

Incurred Cost Submission audit: the annual reckoning. Actuals true up against provisional rates billed during the year.

The Floor Check: unannounced, focused on timekeeping. Employees who can't show current timesheets fail the entire firm.

Building It Without Going Broke

Two paths: QuickBooks plus a compliant timekeeping/expense layer with a GovCon-savvy controller, or a purpose-built entry-level ERP (Unanet, Deltek Costpoint Foundations, JAMIS).

Write the policies before you need them. Timekeeping, expense, unallowable cost, and indirect rate SOPs that match what the software actually does.

Train relentlessly. "I usually fill out my timesheet on Friday" is a failed floor check.

Outsource the complex stuff - month-end close, rate calcs, ICS prep - to a specialized GovCon firm. Keep bookkeeping in-house.

Managing the Auditor

Designate a single audit liaison - usually the Controller or CFO. Be present for every employee interview.

When findings come, respond in writing within the timeline. Acknowledge, explain root cause, describe corrective action. Save your battles for findings you can actually win.

Want help putting this into practice?

Desra Group operates DCAA-compliant accounting and ICS preparation for small defense contractors.

Need the people to execute?

Desra Group places cleared cybersecurity, RMF/GRC, IT, and mission support professionals on defense and federal programs.

This guide is provided for general informational purposes only and does not constitute legal or compliance advice. Specific obligations depend on your contracts and the data you handle.