Your incurred cost submission is almost ready, and one question keeps coming back: which costs will a DCAA auditor question first? If you hold cost-reimbursement work, that question returns every fiscal year.
Handle it wrong and a single unallowable cost can trigger a wider-scope review or a repayment demand. Guess at the rules instead of reading them, and you lose hours defending a position the text itself already settles.
This guide translates FAR and CAS language into plain terms without dropping the citation trail. You will see what triggers a DCAA audit and how auditors are instructed to work. You will also see which costs draw the most findings, a Cost Accounting Standards threshold change effective October 1, 2026, and the tools that help you read the rule, not a summary of it.
A DCAA audit is the Defense Contract Audit Agency's review of a contractor's costs, billing rates, and accounting systems on federal contracts. It is triggered mainly by contracts where the government reimburses actual costs: cost-reimbursement, time-and-materials, and certain incentive contracts.
Firm-fixed-price contracts usually receive less incurred-cost scrutiny because payment generally does not depend on recorded actual costs, though pricing, defective pricing, or business-system reviews can still reach fixed-price work. When cost is the basis for payment, DCAA has a stronger reason to test it directly.
Four audit types come up most often:
The scale is real. In FY 2024, DCAA reviewed $599.8 billion in contract costs and issued 2,465 audit reports, identifying more than $15.9 billion in audit exceptions, according to DCAA's FY 2024 report to Congress.
The DCAA Contract Audit Manual (CAM) is the agency's internal instruction set for its own auditors. It tells them what to test, which documents to request, and how to evaluate what they find.
Reading it is the closest thing to a preview of your audit. When you know the step an auditor will follow on compensation or timekeeping, you can check that item first. Fix it before it becomes a finding.
The DCAA Contract Audit Manual is public, so the playbook the auditor uses is a playbook you can read in advance.
FAR Part 31 cost principles set the rules and procedures for determining allowable costs under Government contracts. Under FAR 31.201-2, a cost is allowable only if it is reasonable, allocable, consistent with cost accounting standards or GAAP where applicable, consistent with your contract terms, and within the limits set elsewhere in the cost principles.
Three terms carry most of the weight in practice:
Keep this general framework in FAR 31.201-2 and 31.201-3 separate from the selected cost items in FAR 31.205. The first sets the test; the second lists individual costs with their own rules.
FAR 31.205 lists the selected cost items, each with its own allowability rule. Some are expressly unallowable, some are allowable subject to conditions, and some depend heavily on documentation, so an auditor can test these categories line by line.
The categories below draw questions year after year. Mapping each one to its exact subsection is the fastest way to know where you stand before an auditor arrives.
FAR 31.205-6 allows compensation only to the extent it is reasonable for the work performed, subject to a statutory benchmark compensation limit. Common flashpoints are bonuses, owner and executive pay, and severance.
This subsection also sets up a harder problem: the same pay may be reported under a second authority entirely. The reconciliation section below walks through it.
Entertainment costs under FAR 31.205-14 are expressly unallowable, and the cost of alcoholic beverages is separately unallowable under FAR 31.205-51. Lobbying and political activity costs under FAR 31.205-22 are unallowable as well.
Segregate these in their own accounts so they never reach a billing rate. Naming the exact subsection in your records makes the treatment easy to defend.
Bad debts under FAR 31.205-3 are unallowable. Interest and other financial costs under FAR 31.205-20 are generally unallowable too.
Flag both in the general ledger before rates are built, so a write-off or a loan payment never lands in an indirect pool.
Cost Accounting Standards (CAS) govern how you measure, assign, and allocate costs consistently across contracts. Coverage comes in two levels, full and modified, and the dollar figures that decide who falls under each level change for covered awards under the revised rule effective October 1, 2026.
The figures most guides still cite come from 48 CFR 9903.201-2: full CAS coverage triggered at a single CAS-covered contract award of $50 million or more, or $50 million or more in net CAS-covered awards during the preceding cost accounting period, with a separate $7.5 million "trigger contract" threshold below which most awards were exempt under 48 CFR 9903.201-1.
Section 1806 of the FY 2026 National Defense Authorization Act, signed December 18, 2025, directed the CAS Board to raise both figures and eliminate the trigger-contract mechanism entirely. The CAS Board's final rule implementing Section 1806 is effective October 1, 2026, with applicability governed by the award-date and transition rules in the statute and final regulation:
For awards covered by the revised rule, the new $35 million and $100 million thresholds apply. For awards still governed by the prior rule, generally those made before June 30, 2026, the older $7.5 million trigger-contract framework and $50 million full-coverage threshold may still control; existing CAS-covered contracts do not retroactively become exempt just because the thresholds moved. Many guides published before the October 1, 2026 change have not caught up to it, so confirm which rule actually governs the specific award, option, or modification in front of you before you rely on either set of numbers.
Once full coverage attaches, you file a Disclosure Statement that documents your cost accounting practices in writing; the threshold for requiring that statement is rising to $100 million alongside the full-coverage threshold.
The incurred cost submission (ICS), formally the final indirect cost rate proposal, reports your actual direct and indirect costs after the fiscal year closes. FAR 52.216-7 sets the deadline: the contractor must submit an adequate final indirect cost rate proposal within six months following the expiration of each of its fiscal years. In practice, the first question is often adequacy: whether the submission includes the required schedules and enough support for DCAA to begin its risk assessment or audit.
The proposal is a package of schedules, commonly labeled A through O, often built around DCAA's Incurred Cost Electronically, or ICE, model. The ones auditors read first include:
Not every submission gets a full-scope audit. GAO's review of DCAA found that DCAA largely eliminated its backlog of incurred cost audits by the end of fiscal year 2018, attributing that result in large part to the agency's risk-based sampling methodology. Federal law also now requires incurred cost audits to be completed within one year of receiving an adequate submission, under 10 U.S.C. 3842; if findings aren't issued within that window, the audit is considered complete.
Provisional billing rates, also called billing rates, are the indirect rates you use to invoice during the year before actual rates are known. You set them at the start of the year and adjust them as actual costs come in.
At year-end, the incurred cost submission produces final rates. The true-up then compares what you billed against what you actually incurred.
Say you billed a 40% overhead rate all year but your actual rate lands at 35%. You over-recovered, so you owe the difference back. Set rates too low and the government owes you, but only up to funded contract limits, which is where cash-flow risk creeps in.
No tool passes a DCAA audit for you, but the right ones remove the guesswork. They fall into three groups: accounting systems, indirect-rate software, and research tools.
Match the tool to the job. A system that records costs correctly differs from software that models rates. Both differ from a tool that tells you what a clause requires.
A DCAA-compliant accounting system separates direct costs from indirect costs and tracks them to the right pools. It also enforces timekeeping rules: daily time entry, total-time accounting, and a full audit trail. No accounting package is automatically "DCAA-approved"; the issue is whether the contractor's system, policies, timekeeping, cost accumulation, and audit trail satisfy the applicable contract requirements.
An accounting system review checks exactly these controls. Government contract accounting software that builds them in is the baseline for any cost-type work.
DCAA compliance software builds and monitors your indirect rate pools and bases. It tracks provisional rates against actuals during the year and assembles the incurred cost submission schedules at year-end.
A research tool answers a different question: what does this clause actually require? Instead of a summary, a citation-backed tool pulls the exact regulatory language and shows its reasoning, so you read the rule rather than someone's paraphrase of it.
Bizora is built around source-backed research: it traces answers to primary authorities and shows the reasoning path behind the conclusion. That transparency matters when a question crosses FAR, CAS, SEC disclosure rules, or tax authorities, because the practitioner needs to verify the actual text rather than rely on a paraphrase.
Here is where cross-authority work gets hard. A government contractor is also an SEC registrant. It pays its CEO a bonus in the same year it must both bill that cost and disclose it.
Under FAR 31.205-6, the compensation is allowable only to the extent it is reasonable for the work performed, capped by the statutory benchmark. Under 17 CFR 229.402, Regulation S-K Item 402, SEC registrants must disclose executive compensation under a separate investor-disclosure framework; depending on the issuer and filing context, that can include summary compensation tables, narrative compensation disclosure, and pay-versus-performance information.
The two authorities do not talk to each other. One asks whether the cost is allowable on a federal contract; the other asks how to report it to the market. Reconciling the same dollar figure against both rulebooks, and documenting how you got there, is exactly the kind of question worth researching against the primary text of each authority rather than a summary of either one.
A DCAA audit rewards preparation over reaction. Read the Contract Audit Manual to see what will be tested, then apply the FAR Part 31 test before costs ever reach a rate.
Watch the FAR 31.205 categories that draw findings, confirm which CAS thresholds actually apply to your award, and meet the incurred cost submission deadline. Keep provisional rates honest so the year-end true-up holds no surprises.
When a question crosses FAR and another authority, like a compensation figure that has to satisfy both FAR 31.205-6 and Reg S-K Item 402, research it against the source text of each rule instead of a summary. For authority-driven research, try Bizora at bizora.ai and review Bizora's plans and pricing, including API and MCP access for connecting research directly into your existing workflow.
The following authorities inform this article:
There is no set dollar threshold. Any contractor with the FAR 52.216-7 Allowable Cost and Payment clause on a cost-reimbursement or time-and-materials contract must file, within six months of fiscal year-end.
Yes, but only to the extent it is reasonable for the work performed under FAR 31.205-6, and only up to the statutory benchmark compensation cap.
FAR Part 31 sets which costs are allowable on a contract. The Cost Accounting Standards govern how costs are measured, assigned, and allocated consistently, and apply based on separate dollar thresholds that change for covered awards effective October 1, 2026.
Audit length varies by type. Incurred cost audits averaged 204 days in FY 2024, and federal law requires them to be completed within one year of an adequate submission under 10 U.S.C. 3842.
A finding of significant deficiency can lead to payment withholds of up to 5% per deficient system (10% maximum across multiple systems) under DFARS 252.242-7005, along with a required corrective action plan.
No. Many contracts remain exempt. For covered awards under the revised rule effective October 1, 2026, the basic applicability threshold rises to $35 million and full CAS coverage attaches at $100 million, up from the older $7.5 million and $50 million figures.
Bizora AI turns hours of manual research into seconds, with every answer backed by primary source citations. Start your 7-day free trial. No credit card required.
Start Free TrialRelated articles