Most executives in aerospace and defense don't worry about timesheets. They're preoccupied with program execution, contract margins, and the win. That is precisely the problem. Labor accounting is where federal auditors uncover their greatest hits, and the downstream impacts of non-compliance are anything but trivial.
DCAA audits resulted in approximately $5.7 billion in questioned costs in fiscal year 2023 (Defense Contract Audit Agency FY2023 Report to Congress). This isn't hypothetical. These are contractors that were confident in their systems until an auditor was kind enough to correct them. For A&D executives overseeing cost-type contracts, "yeah, we capture time" and "we capture time in a manner that meets federal expectations" often makes the difference between building the business and spending the next 36 months litigating what went wrong.
The False Claims Act is not a technicality
If labor mischarging comes up during a DCAA audit, the government doesn't shrug its shoulders and go on to the next issue. It doesn't treat it like an accounting error, either. It treats it as fraud.
The False Claims Act authorizes federal prosecutors to seek treble damages - three times the amount of any fraudulent claim presented to the government for payment. In addition, they can impose substantial civil penalties for each false claim submitted. On a mid-sized cost-plus contract, treble damages plus the statutory penalty can exceed the total value of the contract.
A decade ago, loose timekeeping could and did set the stage for tenuous FCA allegations against some household names in defense contracting. The settlements those companies paid to put the matter to rest were in the tens of millions.
The mechanics that trigger FCA liability aren't always malicious. An employee reallocates hours from indirect codes to a direct contract because a program manager told him the budget had room. A supervisor adjusts timesheets at the end of the pay period to smooth out cost variances. A project lead reconstructs her week on Friday afternoon based on rough memory and charges everything to her primary contract. None of these people think they're committing fraud. Federal investigators see it differently.
Under FAR Part 31, labor costs must be allocable, allowable, and reasonably distributed. Mischarging indirect hours - overhead, G&A, or IR&D - as direct labor on a specific contract violates that standard. It also violates Cost Accounting Standards, which require consistency in how costs are estimated, accumulated, and reported. When those two violations appear together in an audit finding, the False Claims Act isn't far behind.
What a DCAA floor check actually looks like
Most contractors understand the idea of a DCAA audit but downplay how much a floor check can disrupt operations.
A floor check is unannounced. Auditors - today virtual, tomorrow potentially roaming the office - cross reference which charge codes are currently active in the time system against what employees say they're working on at that moment. The question is simple: does your timesheet reflect what you're actually doing right now, today, at this hour?
If employees have been reconstructing their time at the end of the week based on memory, the answers won't match. An employee who spent Tuesday working on a proposal effort but charged Monday through Wednesday to a cost-reimbursable contract because she forgot to switch charge codes won't be able to explain the discrepancy. Multiply that across a 200 person engineering team and you have a systemic problem, not an isolated one.
The reason DCAA insists that employees record time daily is to enforce this test. DCAA doesn't trust memory-reconstructed timesheets because it knows they can't reliably pass a floor check. One minor inaccuracy (employee was actually in a meeting Tuesday morning but didn't enter this) could be the thread that unravels a multimillion-dollar tapestry.
Where manual processes introduce structural risk
Technical failures in non-compliant timekeeping systems follow predictable patterns.
First, there is no audit trail that cannot be modified. A compliant system needs to record every entry, any modifications, and all approvals using a timestamp and the user's ID, which can't be changed retroactively. When an auditor inquires who changed a timesheet on a certain date and for what reason, the system should provide the answer, not an email chain or human memory. The same goes for spreadsheets and basic time tools that allow entries to be replaced without generating logs.
Second, the system lacks the structural separation of duties. A program manager should not be able to alter an employee's timesheet without the employee being aware of it and providing their explicit approval along with a digital signature. If a program manager can modify the direct labor hours without informing and getting the employee's approval, then there is no way to defend against accusations about labor manipulation from higher-up managers. The work-performer's identity, the time-approval person, and the payroll admin must be distinct entities, and the system must independently log every stage.
The third issue is disconnected systems. Most A&D companies use time-tracking software that does not directly integrate with their ERP or payroll system. Transferring data manually between these systems exposes it to integrity vulnerabilities. For DCAA Pre-Award Surveys - the SF 1408 inspection where a determination is made about a company's ability to manage cost-type contracts - auditors verify if the timekeeping and accounting systems share common data. When they do not, the contractor fails the survey and is disqualified from bidding on cost-reimbursable projects.
To mitigate these dangers and meet the technical requirements federal regulations demand, defense contractors need to move beyond spreadsheets and implement the Best DCAA Compliant timekeeping software capable of enforcing daily recording, creating tamper-proof audit trails, and validating charge codes against the active Work Breakdown Structure - all without leaving this responsibility to the workforce's memory or another manual check in the office.
The real cost of audit defense
Executives are willing to risk manual timekeeping because they perceive the cost of non-compliance as a vague concept. That abstraction disappears once the audit starts.
When DCAA identifies a material finding, the response includes the contractor's accounting department repurposed as a forensic team to reconstruct labor distribution for the entire affected period. External legal counsel to manage communication with the government, and possibly respond to investigative activity. Internal leadership hours diverted from program execution to document review, interview preparation, and corrective action planning. Costs begin immediately and continue for months or years.
Nor do those costs include the actual damages if the matter escalates. They don't include the reputational cost of a finding being plainly visible to all contracting officers when the company is trying to win a new award. They don't include the operational paralysis that sets in when your senior leaders are spending 30% of their time on audit response instead of running the business.
Suspension and debarment is the death penalty for defense contractors. It doesn't happen on a first offense, but it happens. When the government won't let you have any federal business, there is no revenue to offset those legal fees, no contracts to keep the lights on, and no obvious route back in. For a firm whose entire business model depends on government contracting, debarment isn't a fine. It's a foreclosure.
Retroactive adjustments and the mandatory reason code
There will be times when timesheets need to be fixed and that's okay. The real issue is whether your system makes corrections in a manner that meets federal standards.
For every single retroactive change to a submitted timesheet, a mandatory reason code must be required. The "correcting charge code allocation" explanation is not acceptable. This means that the reason code must say what was wrong, provide the correction as well as who authorized it. The original entry must reference the incorrect code and stay in the record. The change and its reason must be stored alongside it in a format that can't be tampered with.
Auditors will look at correction patterns. If a contractor's timesheets continuously have lots of changes just prior to invoices being agreed upon or if all the times tend to be shifted from indirect to productive high-value direct contracts, this is evidence of a systemic problem. Without mandatory reason codes enforced by the system, those patterns are impossible to refute. But if you have the reason codes documented at the time of changes, you have contemporaneous evidence to support every correction.
The WBS is equally important here. Charge codes in a compliant system should be mapped one-to-one to WBS elements on active contracts. Each entry on a compliant timesheet should be checked against the list of current open contract codes and immediately flagged if no match is found.
Compliance as a revenue strategy
Here's a way to think about it for A&D executives: labor compliance infrastructure should not be viewed as a cost center, but rather as a qualification requirement for a very specific category of incredibly high-value government work.
Among the most lucrative contracting vehicles in all of government contracting are cost-reimbursable contracts (specifically, cost-plus-fixed-fee, cost-plus-award-fee, and cost-plus-incentive-fee). They authorize you as the contractor to recover your actual costs paid, then add in a negotiated fee. By design, the fee adds a layer of profit but is not eroded by cost overruns the way it is on fixed-price work.
To win a cost-reimbursable contract, the contractor has to pass the SF 1408 Pre-Award Survey of Prospective Contractor Accounting System. The SF 1408 is an auditor's opinion on whether your accounting system and controls are adequate to accumulate costs under a cost-type contract. Timekeeping makes up the largest component in determining an adequate labor accounting system (which is what the government's auditors call automated daily entry enforcement, system-generated audit trails, proper segregation of duties, and direct interface between the timekeeping and accounting systems).
Contractors that clear the SF 1408 have access to contract vehicles their non-compliant competitors can't pursue. That's a competitive position, not just a compliance checkbox.
Building the infrastructure before the auditor calls
It's not the right time to resolve any issues with labor accounting when a floor check is already underway. At that point, the record is what it is. The audit results will show the controls that were in place - or that were not in place - when the work was completed.
Business leaders who view DCAA-compliant timekeeping as a strategic investment rather than an administrative burden are building something real: a company that can withstand an audit, win cost-type contracts, and expand its government contracting portfolio without existential risk hanging over every invoice cycle. The alternative is cheaper in the near term and catastrophically expensive when it fails.
