DCAA Timesheet Audit: How to Prepare Your Records

Updated September 2026
Government contractors do not pass a DCAA timesheet audit simply by purchasing software labeled "DCAA compliant." The stronger test is whether employees follow documented timekeeping procedures and whether the contractor can produce reliable records showing how labor was entered, corrected, approved, distributed, and reconciled.

That distinction matters because the Defense Contract Audit Agency does not certify commercial timekeeping products. DCAA evaluates contractor submissions, systems, internal controls, procedures, and supporting records based on the type of contract and the applicable requirements.

The practical goal is not to prepare for an audit at the last minute. It is to operate a timekeeping process that produces understandable evidence every day.

What does a DCAA labor review examine?

DCAA conducts different types of audits and reviews. The scope that applies to a contractor depends on its contracts and circumstances. Two areas are especially relevant to timekeeping:

• Labor floor checks and employee interviews: DCAA's current audit-program directory includes separate labor floor-check programs for major and non-major contractors. The program for non-major contractors describes objectives that include testing compliance with the contractor's own timekeeping controls and procedures, assessing the reliability of employee time records, and determining whether employees charge time to the proper cost objective.
• Accounting-system reviews: DFARS 252.242-7006 identifies a timekeeping system that records employee labor by intermediate or final cost objectives and a labor-distribution system that charges direct and indirect labor to the appropriate cost objectives among its accounting-system criteria. The clause applies when it is included in the contractor's agreement, so contractors should confirm their own contractual requirements.

During a labor floor check or interview, an auditor may compare what an employee is doing with the project, job classification, and charge number recorded in the timekeeping system. DCAA guidance also discusses reviewing employee understanding of timekeeping procedures, how employees receive charge numbers, how often they enter time, whether they record all hours worked, and how submission and approval work.

That means audit preparation involves more than producing a clean final timesheet. The records and the people using the process should tell the same story.

1. Start with the requirements in your contracts and procedures

Before evaluating a timekeeping system, identify the requirements that apply to your organization. Consider:

• Contract type and clauses
• Agency-specific requirements
• Direct and indirect cost structure
• Cost objectives and labor categories
• Billing and payroll processes
• Record-retention obligations
• Remote, off-site, mobile, and secure-facility work

Then document how employees, supervisors, finance, payroll, and system administrators are expected to handle time.

DCAA's Information for Contractors recommends written instructions that address daily employee entry, project or contract coding, corrections, recording all hours worked, employee certification, and supervisor approval. The guidance also recognizes that employees in off-site or secure locations may not have daily access to an electronic system and says contractors should establish procedures to mitigate that risk.

The policy should match actual operations. A procedure that employees cannot follow in the field, in a secure facility, or while offline is unlikely to produce reliable evidence.

2. Make employees responsible for their own time

Employees should understand that accurate timekeeping is part of their job, not an administrative cleanup task for finance at the end of the week.

A strong process establishes:

• When employees must record time
• Which hours must be recorded
• How employees select the appropriate project, task, contract, or indirect account
• How employees confirm that their entries are complete
• What to do when a valid charge code is unavailable
• How to report an error after submission

DCAA's contractor guidance calls for employees to record time daily and certify that the hours and cost objectives are accurate at the end of the work period. It also emphasizes that the nature of the work should determine where time is charged, rather than funding availability or another unrelated factor.

Software can make these procedures easier to follow through required fields, authorized charge-code lists, reminders, mobile access, and offline entry. Those capabilities still need to be configured around the contractor's procedures and monitored in daily use.

3. Preserve corrections instead of overwriting them

Mistakes happen. The control question is whether a correction leaves the record understandable.

For each correction, an auditor or internal reviewer should be able to determine:

• The original entry
• The corrected entry
• Who made the change
• When the change occurred
• Why the entry changed
• Whether the employee agreed with a change made by someone else
• Whether the change occurred before or after submission or approval

DCAA's Information for Contractors recommends procedures that identify the original and corrected time charges and document the employee's concurrence with a change.

During a software demonstration, ask the vendor to correct a real example in front of you. Then inspect the employee record, approval history, and audit report. A statement that the product "has an audit trail" is less useful than seeing exactly what the trail preserves.

4. Review approvals and privileged access

Supervisor approval provides an additional review of labor charges, but an approval button is not enough by itself. Contractors should understand:

• Who can approve each employee's time
• Whether employees can approve their own records
• How delegated approvers are handled
• Who can reopen an approved period
• Who can enter or change time on an employee's behalf
• Whether proxy and administrative actions are visibly identified
• Whether rejection, correction, resubmission, and reapproval remain traceable

DCAA guidance generally places responsibility for preparing the timesheet with the employee and calls for supervisor approval. It limits supervisor preparation of an employee's timesheet to defined circumstances, such as prolonged authorized absence, with employee follow-up when the employee returns.

Review administrator and approver permissions periodically. Access that made sense during implementation may no longer be appropriate after organizational or staffing changes.

5. Control project, job, and labor-category selections

Employees need enough information to select the correct charge code without guessing. The timekeeping process should provide current project descriptions and prevent employees from using codes they are not authorized to charge.

Evaluate whether the system can:

• Limit codes by employee, role, project, contract, or effective date
• Prevent new charges to closed or inactive work
• Require the project, task, labor category, or other dimensions needed by accounting
• Distinguish direct and indirect time
• Route exceptions for review
• Preserve changes to project and charge-code assignments

This control connects the employee's daily record with the broader accounting system. DFARS 252.242-7006 includes identification and accumulation of direct costs by contract, appropriate allocation of indirect costs, labor distribution to the correct cost objectives, and reconciliation of subsidiary records to the general ledger among its criteria.

6. Reconcile timekeeping, labor distribution, payroll, and billing

A timesheet may appear correct while downstream labor records do not match it. Finance should test the complete path from employee entry through approval, payroll, project accounting, billing, and the general ledger.

Useful reconciliation questions include:

• Do approved hours agree with payroll records?
• Can labor-distribution records be traced back to employee time and forward to project or general-ledger records?
• Are direct and indirect charges posted to the appropriate cost objectives?
• Are rejected, duplicate, incomplete, or adjusted transfers visible?
• Can billing records be reconciled with accumulated costs?
• Are integration mappings and errors reviewed by a named owner?

DCAA has described floor-check work that may include reconciling observed labor charges with payroll records and tracing labor charges to contract requirements. Accounting-system criteria also address labor distribution, general-ledger control, reconciliation, documented adjustments, and billing reconciliation.

Do not limit software evaluation to the entry screen. Ask to see the record after approval, export, correction, and downstream posting.

7. Train employees and test the process before an auditor does

Employees should be able to explain the process in plain language. They do not need to recite regulations, but they should know:

• How and when they record time
• How they receive authorized charge codes
• How they distinguish projects or indirect activities
• What they do when a code is missing or incorrect
• How they correct an error
• Who reviews their time

Training should be documented and repeated when procedures, systems, contracts, or employee responsibilities change.

Internal spot checks can reveal whether the written process matches actual behavior. Select a small sample of employees and records, then trace each example from work assignment through time entry, correction history, approval, labor distribution, payroll, and billing. Include remote and off-site employees rather than testing only office-based workflows.

8. Retain the records required for your environment

There is no single retention number that should be repeated for every timekeeping record and every government contract.

FAR Subpart 4.7 contains different periods for different record classes and explains when those provisions apply. For example, it lists two years for labor cost distribution cards or equivalent documents and two years for clock cards or other time-and-attendance cards, while payroll records have a four-year period. FAR 4.703 also addresses three years after final payment, shorter specific periods, contractual extensions, and other circumstances that can change the calculation.

Contractors should have legal or compliance counsel confirm the requirements that apply to their records and contracts. Their systems should then preserve the data, audit trail, approvals, and supporting records for the selected period.

DATABASICS retains customer records for seven years by default. That is a product default, not a substitute for determining the contractor's legal and contractual obligations.

A practical DCAA timesheet audit preparation checklist

Before an audit or internal review, confirm that you can answer yes to the following:

• We have written timekeeping procedures that reflect how employees actually work.
• Employees know when and how to record their own time.
• Employees have access only to appropriate project, task, and labor codes.
• Late entries and corrections require an explanation under our policy.
• Original and corrected values remain visible.
• Employee, supervisor, proxy, and administrator actions are traceable.
• Employees cannot approve their own time under our standard workflow.
• Approved time can be reconciled with labor distribution, payroll, project accounting, billing, and the general ledger.
• Remote, mobile, offline, and shared-clock workflows preserve the controls we rely on.
• Access rights are reviewed periodically.
• Training and internal spot checks are documented.
• Records are retained according to applicable contract, regulatory, and company requirements.

For a more detailed review, use the DCAA timekeeping evaluation checklist.

How DATABASICS supports audit-ready timekeeping

DATABASICS time tracking can be configured to support same-day entry rules, required explanations for late entries or corrections, traceable revision history, approval routing, project and labor-category controls, role-based access, labor reporting, and downstream reconciliation.

Those system capabilities support a contractor's control environment. The contractor remains responsible for defining its procedures, configuring the system appropriately, training employees, monitoring exceptions, and confirming which requirements apply.

Organizations evaluating timekeeping for government contracts should ask vendors to demonstrate the full record path instead of relying on a compliance label.

Request a compliance-focused walkthrough

Frequently asked questions

Does DCAA certify timesheet software?

No. DCAA audits contractor systems, procedures, records, and submissions based on applicable requirements. Buyers should evaluate the controls and evidence a product supports rather than treating a product label as government certification.

Does DCAA require employees to enter time every day?

DCAA's Information for Contractors recommends daily employee time entry and accurate distribution to the appropriate cost objective. Contractors should translate the applicable guidance and contract requirements into written procedures employees can follow.

What happens during a DCAA labor floor check?

DCAA may observe or interview employees, review their understanding of timekeeping procedures, compare current work with job classifications and charge codes, and test whether time records are reliable. The exact scope depends on the audit program and contractor risk.

Can a supervisor change an employee's timesheet?

Contractors should strictly control proxy entry and supervisor changes. Any permitted action should preserve the original entry, identify the person making the change, document the reason, and capture employee concurrence when required by the contractor's procedure.

How long should DCAA-related timesheet records be retained?

It depends on the type of record, applicable contract clauses, timing, and other requirements. FAR Subpart 4.7 contains different retention periods for labor-distribution, time-and-attendance, payroll, and other records. Contractors should confirm the applicable period with compliance or legal counsel.

Sources for compliance review

• DCAA Directory of Audit Programs
• DCAA Information for Contractors
• DCAA overview of floor checks and material cost audits
• DFARS 252.242-7006 Accounting System Administration
• FAR Subpart 4.7 Contractor Records Retention