DCAA-compliant timekeeping for federal contractors: how GPS apps satisfy DFARS 252.242-7006

The Defense Contract Audit Agency arrived without warning on a Wednesday morning at a Northern Virginia engineering firm that does about $40 million annually in federal subcontracting work. Two auditors walked in at 9 AM, presented credentials, and asked to see three months of timesheet data, all subcontractor records, and a written description of how labor hours were tracked, segregated by contract, and approved. The CFO sat with them in a small conference room. She produced exports from a popular small-business time tracking app the company had used for the past two years. The lead auditor’s first observation was technical: the audit trail showed that several timesheets had been “edited” after the original submission. There were no edit-reason notes attached. There was no countersignature from a supervisor verifying the edit. DCAA’s standard interpretation of edited timesheets without controls is a finding, and findings, in DCAA parlance, are the well-marked path to suspension of progress payments and, in the worst cases, debarment from federal contracting.

DCAA audits federal contractors under the Federal Acquisition Regulation (FAR Part 31), the Defense Federal Acquisition Regulation Supplement (DFARS 252.242-7006 on Accounting System Administration), and the Cost Accounting Standards. The single requirement that drives most timekeeping decisions in this universe is the principle of contemporaneous recording. The employee enters time on the day it was worked, before the workweek closes. Anything else is reconstructed evidence, and reconstructed evidence is subject to verification by the auditor through interviews, cross-references, and forensic review of system logs.

Federal contractors who haven’t been through a DCAA audit often misunderstand what’s at stake. The auditor is not looking for fraud, fraud is the FBI’s department. The auditor is looking for inadequate internal controls. An inadequate timekeeping system can lose you the next contract award, even if no actual misallocation of cost ever occurred. The downstream effect is that contracting officers stop short-listing your company, and your federal pipeline starves over twelve to eighteen months.

The total time accounting rule

DCAA expects one hundred percent of labor hours to be accounted for, including indirect labor, vacation, sick time, holidays, training, idle time, not just the billable hours charged to contract. A common mistake among small federal contractors is tracking only contract-direct hours and inferring indirect labor from headcount and estimated allocations. DCAA categorically rejects that approach. Every employee should record every hour, allocated to a specific direct or indirect labor account. This is what auditors mean by “total time accounting”: no gaps, no estimates, no reconstructions.

A GPS clock-in system that requires the worker to select a task code at every clock-in produces total time accounting natively. The task codes map to direct contract charges (C-001, C-002 by contract) or indirect labor accounts (G&A, Fringe, Overhead pools). The audit trail shows the worker actively classified each segment of the day as it happened, not the contractor backfilled it the following week from memory or supervisor guesswork. When the DCAA auditor pulls the labor distribution report and traces a sample of hours back to the underlying time records, the chain of evidence is unbroken.

Segregation by contract

Multi-contract federal work requires that hours be cleanly segregated by contract, and that labor charges flow through to the correct invoice for the correct contract. DCAA Pre-Award Surveys frequently flag contractors whose time tracking can’t demonstrate segregation. The system has to enforce contract selection at the moment of clock-in, prevent re-allocation after submission, and produce reports per contract on demand. Without segregation, the auditor can’t verify that the direct labor costs charged to Contract A actually corresponded to work performed on Contract A, and if that link can’t be drawn, every cost charged is subject to disallowance.

The architectural choice that makes this clean is requiring contract selection as part of the clock-in flow. The worker sees a list of contracts they’re currently assigned to; they pick one; the clock starts running against that contract’s labor pool. Switching to a different contract requires a clock-out, a new selection, and a new clock-in, creating an explicit boundary between the two periods. When the system aggregates labor at month-end, the contract attribution is mechanical, not inferential.

Supervisor approval and the audit trail

DCAA expects timesheets to be reviewed and approved by an immediate supervisor, not merely by the employee. A weekly approval workflow with named supervisor, timestamp, and supervisor signature is the standard. The supervisor’s role is to verify that the time charges accurately reflect work performed, that contracts are correctly attributed, and that overtime is justified by contract requirements rather than employee preference.

GPS clock-in systems with multi-step approval workflows, signature-equivalent sign-off, and immutable audit logs satisfy this requirement without manual ceremony. The supervisor sees the week’s hours per employee, reviews any flagged anomalies (excessive overtime, classification changes, contract switches), and approves with a single click. The system records the supervisor’s identity, the timestamp of approval, and freezes the records against further modification. If the auditor later asks “who approved this week’s labor distribution?”, the answer is one query away.

Edited timesheets and the cryptographic seal

The single fastest way to fail a DCAA audit is to produce timesheets where DCAA can see entries were changed after the close of the work period without a documented justification. The acceptable practice is corrections via labor adjustments, explicit journal entries with documented reasons, not by editing the original entry. The principle: the original record stays as it was; the correction creates a separate, traceable record that explains what changed and why.

GPS clock-in systems that use cryptographic sealing of records (each entry’s hash chained to the previous, so that undetected modification is mathematically impossible) eliminate this risk entirely. The original entry exists forever. Any subsequent correction is a separate, linked entry with its own timestamp, author, and justification field. The auditor sees the full lineage of every hour from the moment it was recorded to the moment it was billed. There is no “smudge” in the record; there is no “the foreman re-wrote that sheet in pencil” defense to fail.

Floor checks and the unannounced visit

DCAA reserves the right to conduct unannounced “floor checks”, auditors physically arrive at the contractor’s worksite or office and ask current employees, in real time, what they’re working on, what contract it’s being charged to, and whether they’ve actually been at work during the hours they claimed. This is the moment paper-based or self-reported timekeeping systems collapse: the employee says “I’m working on the XYZ contract right now” but the system shows them as clocked in to the ABC contract, or as not clocked in at all. The auditor notes the discrepancy and you’re in a finding.

A GPS clock-in system passes floor checks cleanly. The auditor asks the employee what contract they’re on; the employee says XYZ; the auditor checks the time tracking dashboard from his laptop; XYZ matches. The system also shows the employee’s GPS location matches the worksite, that the clock-in timestamp corresponds to the time the security desk recorded them entering the building, and that the supervisor approved the previous week’s hours on Monday. Floor check passed in two minutes.

For federal contractors, DCAA-readiness is binary

Either your timekeeping system can survive an unannounced audit on a Wednesday morning, or it can’t. There’s no “mostly compliant” middle ground in DCAA’s framework, the system either meets the contemporaneous-recording, segregation-by-contract, supervisor-approval, and audit-trail standards, or it generates findings. GPS-stamped, cryptographically sealed clock-ins with role-based approval workflows and contract-aware geofencing turn DCAA from an existential threat into a formality. The auditor walks in, you hand them the system access, they verify the controls, they leave. The contract pipeline stays open.

---

Worked a DCAA audit before? What did the auditor focus on first, the system controls, the labor distribution, or the supervisor approvals? Share in the comments.

Picture the next DCAA floor check, and your timekeeping segregation of direct and indirect labour holds without a memo.