DCAA Timekeeping Requirements: What the Regulations Actually Say

The Defense Contract Audit Agency issues no timekeeping regulation. The requirements come from the contract: DFARS 252.242-7006(c)(9) and (c)(10) require a timekeeping system that identifies labor by cost objective and a labor distribution system that charges direct and indirect labor correctly. Everything else called a “DCAA requirement” is audit practice derived from those two criteria and from the FAR cost principles. DCAA puts it bluntly itself: “There is no such thing as a DCAA approved government accounting system.”

> This is not legal or accounting advice. This page describes what the cited regulations say. Whether a requirement applies to your contract depends on which clauses that contract contains. Verify against your contract and your cognizant contracting officer before acting. Regulations were checked against primary sources on 22 October 2026; both DFARS clauses are current at (JAN 2025).

Key takeaways

• DCAA audits contractors against the FAR, DFARS and the contract. It publishes no timekeeping rule and approves no software.
• The entire regulatory text on timekeeping is two subparagraphs of DFARS 252.242-7006 — criteria (c)(9) and (c)(10) of 18.
• Timesheets carry a 2-year retention period under FAR 4.705-2(b). The payroll register built from them keeps for 4, and the clock on both starts later than most people think.
• A disapproved accounting system triggers a 5% payment withhold, reduced to 2% on an accepted corrective action plan, capped at 10% across multiple systems — but only on contracts subject to the Cost Accounting Standards.
• A floor check is MAAR 6, and DCAA tells its auditors to make it unannounced and to look for “corrections, alterations, whiteouts”.

Which regulation sets the requirements?

There is no DCAA timekeeping regulation. The Defense Contract Audit Agency is an audit agency within the Department of Defense; it examines contractor costs and systems against the Federal Acquisition Regulation, the Defense FAR Supplement and the terms of the contract. “DCAA requirements” is shorthand for what DCAA auditors test, and the authority sits elsewhere. Contractors who also hold civilian-agency work meet the same pattern under other regimes — OFCCP compliance is audited the same way, against rules written somewhere other than the auditing body.

The two criteria that govern timekeeping read in full as follows.

DFARS 252.242-7006(c)(9): “A timekeeping system that identifies employees’ labor by intermediate or final cost objectives.”

DFARS 252.242-7006(c)(10): “A labor distribution system that charges direct and indirect labor to the appropriate cost objectives.”

That is the whole of it. Daily entry, supervisor approval, employee-recorded timesheets, complete capture of hours worked and documented corrections are all audit expectations built on top of those two sentences — they are how auditors satisfy themselves that labor is in fact identified by cost objective and charged correctly. Knowing which is which matters when a practice is challenged: a derived expectation can be met in more than one way, a clause cannot.

A word that changed in 2025

Both clauses were revised in January 2025. The operative term is now material weakness — “a deficiency or combination of deficiencies in the internal control over information in contractor business systems, such that there is a reasonable possibility that a material misstatement of such information will not be prevented, or detected and corrected, on a timely basis” — where it used to be “significant deficiency”. The change came in with section 806 of Pub. L. 116-283, and the clause now puts a probability gloss on the standard: a reasonable possibility exists where the likelihood is “probable” or “more than remote but less than likely”. Most commentary still uses the old word, which is a quick way to tell how recently a page was written.

What must an acceptable timekeeping system do?

DFARS 252.242-7006(c) lists 18 criteria for an acceptable accounting system. Two are specific to labor; several others constrain timekeeping indirectly. The text below is the clause’s own wording.

One criterion is routinely misread. (c)(7) covers adjusting entries in the accounting records. It is the one criterion that can be misread as governing timesheet corrections, and it does not. The expectation that a timesheet correction leaves a trail is an audit expectation like the others — a well-founded one, as the next section shows, but not this clause. Charging below the contract level, under (c)(13), is the criterion that most often drives the structure of a project time tracking setup.

The clause also states the obligation plainly, at 252.242-7006(b): “The Contractor shall establish and maintain an acceptable accounting system. Failure to maintain an acceptable accounting system, as defined in this clause, shall result in the withholding of payments if the contract includes the clause at 252.242-7005, Contractor Business Systems, and also may result in disapproval of the system.”

Is total time accounting actually required?

No clause mandates it, and — a point worth making because almost every page on this subject assumes otherwise — DCAA does not use the phrase either. It does not appear in any DCAA document reachable online. What DCAA publishes is the substance, in plainer words: its pre-award accounting system briefing tells contractors to “include all hours worked including uncompensated overtime”.

Recording all hours worked, not only the hours charged to contracts, is an expectation derived from two of the criteria above, and the derivation is worth following because it tells you what breaks.

Indirect cost rates are a ratio: an indirect cost pool divided by an allocation base, and for labor-based pools that base is hours or dollars of labor. If employees record only the hours they charge to contracts and omit the rest, the base is understated. An understated base inflates the rate, which shifts indirect cost onto the contracts that were recorded. At that point the contractor is no longer meeting (c)(4), which requires “a logical and consistent method for the accumulation and allocation of indirect costs”, or (c)(15)(ii), which requires the system to produce cost accounting information sufficient “to readily calculate indirect cost rates from the books of accounts”.

Note the pin cite. The indirect-rate language is a sub-item: (c)(15) is the lead-in, “Cost accounting information, as required”, and the rate requirement is at (c)(15)(ii). Citing (c)(15) alone points at a sentence fragment.

That is why the expectation extends to salaried exempt employees who work beyond a standard week. Those hours cost the employer nothing extra, but leaving them out of the base distorts every rate built on it. The same logic is why the split between billable and non-billable hours has to be recorded rather than inferred.

How long do you have to keep timesheets?

First, a question most articles on this subject skip: does FAR Subpart 4.7 apply to you at all? It is clause-driven. Under FAR 4.702 the subpart applies to records generated under contracts containing 52.214-26, Audit and Records — Sealed Bidding or 52.215-2, Audit and Records — Negotiation, and FAR 15.209(b)(1) keeps that second clause out of three categories of contract:

• At or below the simplified acquisition threshold — FAR 15.209(b)(1)(i)
• Utility services at published uniform rates — FAR 15.209(b)(1)(ii)
• Commercial products or services exempted under 15.403-1 — FAR 15.209(b)(1)(iii)

ARRA-funded contracts lose all three exemptions. Note also that the FAR states the simplified acquisition threshold by reference and prints no dollar figure, so neither does this page; check the current figure at FAR 2.101.

Where the subpart does apply, it sets specific periods by record type, and timesheets are in the shortest category.

The exact wording at FAR 4.705-2(b) is: “Clock cards or other time and attendance cards: Retain 2 years.”

The asymmetry is the thing to notice. The timesheet keeps for 2 years; the payroll register built from it keeps for 4. The source document for the hours may be destroyed 2 years before the record of what was paid for them. If a question about those hours arrives in year three, the answer is in the register and the evidence is not.

Three things make the short period misleading in practice.

The clock does not start at the timesheet date — and FAR 4.704(a) has two sentences, not one. The first: “The retention periods in 4.705 are calculated from the end of the contractor’s fiscal year in which an entry is made charging or allocating a cost to a Government contract or subcontract.” The second, which is the operative one here: “If a specific record contains a series of entries, the retention period is calculated from the end of the contractor’s fiscal year in which the final entry is made.” A timesheet, a payroll register and a labor distribution record are all multi-entry documents, so the series rule governs.

Worked through: a timesheet written in January 2024, on a record whose final entry falls in fiscal 2027, must be kept for 2 years from the end of fiscal 2027 — until the end of 2029. That is 5.9 years of life for the document under a two-year rule. Destroying it two years after it was written would destroy it 3.9 years early; destroying it three years after, 2.9 years early.

Three mechanisms push the period out further.

• The three-year-after-final-payment floor (FAR 4.703(a)(1)). The two-year periods apply only where they expire first. On a long contract three years after final payment can be the later date.
• A late final indirect cost rate proposal (FAR 4.703(b)(3)). The 4.705 periods are automatically extended one day for each day the proposal is not submitted after its original due date under 52.216-7(d)(2).
• Interfiling (FAR 4.704(c)). If two or more record categories are interfiled and screening for disposal is not practical, the whole series is kept for the longest period that applies to any category in it — which turns two years into four.

And scanning the paper does not end the obligation. FAR 4.703(c) lets a contractor produce electronic images instead of originals, but only on conditions — one of which is that “The contractor or subcontractor retains the original records for a minimum of one year after imaging to permit periodic validation of the imaging systems.” A contractor that scans its paper timesheets and shreds them the same week has not met it. And under FAR 4.703(d), for records held on a computer: “For the record retention time periods prescribed, contractors shall not destroy, discard, delete, or write over such computer data.”

The practical rule is to take the period from the contract clauses first and treat the 4.705 figures as the floor, not the schedule.

What is a DCAA floor check?

A floor check is the labor-cost procedure DCAA identifies as MAAR 6 — the audit program is titled “MAAR 6 – Labor Floorchecks or Interviews”. MAAR stands for Mandatory Annual Audit Requirements.

DCAA’s own audit program separates two techniques that most summaries run together. A floorcheck has two objectives: verify the existence of employees who bill to the contract, and evaluate timekeeping internal control procedures. An interview has a third: to “evaluate the accuracy of contractor employee (salaried and/or hourly) labor hour charges to contracts, indirect accounts, or other cost objectives”. The program tells auditors that observation is appropriate “when there is limited Government risk or vulnerability” and that where there is a high probability of mischarging, “employee interviews should be performed”.

The visit is unannounced. DCAA’s own briefing for new contractors says so in terms: “Labor floorchecks will be unannounced, so discretion is key.” It adds: “Do not announce to your workforce that DCAA is there to conduct interviews.” The timing is deliberate rather than secretive — the contractor is told in advance that unannounced floorchecks will happen, and the notification letter is handed over at the first one rather than before it.

On site, DCAA describes auditors as doing five things: interviewing or floor-checking employees at their work site with an unannounced visit; discussing and observing work to determine whether employees are performing in the proper labor categories and charging time correctly; reviewing timekeeping procedures to determine compliance with the contract; reconciling observations on employees’ labor charges with payroll records and following up on discrepancies; and tracing labor charges to contract requirements.

What the auditor looks for in the records

The audit program is more specific than any secondary summary, and these four lines are the ones worth reading twice:

• “any informal records used to record time”
• “changes in charging patterns, corrections, alterations, whiteouts”
• “indications that someone other than the employee is completing the timecard”
• “all changes are properly initialed/approved by the employee and the designated approving supervisor”

The first is the scratch-paper problem: DCAA expressly looks for informal records used to capture time before it reaches the system. The third is the reason an administrator entering time on an employee’s behalf is a finding rather than an efficiency.

The implication for daily practice is narrow and specific. A floor check compares what an employee is doing at a moment against what that employee’s timesheet says for that moment. Time entered a week later from memory cannot survive that comparison, which is the real reason daily entry matters — not a rule that says “enter daily”, but a test that only same-day records pass. DCAA states the expectation itself, in a pre-award briefing: “Ensure your employees are recording their time at least once a day”.

What happens if timekeeping fails the audit?

The consequence that applies first is a payment withhold, and it is quantified. One precondition first: under its own paragraph (a), DFARS 252.242-7005 “This clause only applies to covered contracts that are subject to the Cost Accounting Standards under 41 U.S.C. chapter 15, as implemented in regulations found at 48 CFR 9903.201-1”. If the contract is not CAS-covered and does not carry the clause, this section does not apply to it.

Where it does apply, the clause reaches six business systems, each only if the contract carries its own clause:

Accounting system (252.242-7006), Earned value management system (252.234-7002), Estimating system (252.215-7002), Material management and accounting system (252.242-7004), Property management system (252.245-7003), Purchasing system (252.244-7001).

On a monthly interim voucher of $500,000.00:

The reduction to 2% cannot arrive quickly. The contractor has 30 days to respond to the initial determination and 45 days from the final determination to correct the weaknesses or submit an acceptable plan — a minimum of 75 days, about 2.5 months, before the lower rate can apply, and only if the plan is accepted and is being implemented.

Three months at 5% followed by six at 2% on that voucher holds $135,000.00 of cash. The same nine months without an accepted plan holds $225,000.00 — so the plan is worth $90,000.00 of working capital, which is a better argument for writing one quickly than any compliance language. At the 10% cap the same nine months holds $450,000.00.

What a withhold actually costs

A withhold is deferred cash, not a fine: the clause releases it once the contracting officer determines the weaknesses are corrected. So the cost is the carry on the money rather than the money. Across the nine months above, the average balance outstanding is $90,000.00; at an illustrative 8% cost of capital that is about $5,400.00.

Two provisions sharpen that. The clause says the withholding “the payment withholding authorized in this clause is not subject to the interest-penalty provisions of the prompt payment act.” — so the government pays no interest on the held balance, and the carry is real. And “Payment withholding shall not apply to payments on fixed-price line items where performance is complete and the items were accepted by the Government.”, which limits the exposure for a contractor whose work is mostly completed fixed-price line items.

One trap: “if at any time, the Contracting Officer determines that the Contractor has failed to follow the accepted corrective action plan, the Contracting Officer will increase … the percentage withheld on interim cost vouchers to the percentage initially withheld”. The withhold returns to the initial rate the moment the contracting officer decides the plan is not being followed, with no cure period.

Disallowed costs, contract termination and debarment exist as further consequences, but they are not automatic and not immediate. Debarment in particular is a discretionary administrative action under FAR Subpart 9.4, decided by a debarring official; a timekeeping deficiency is evidence in that decision, not a trigger for it.

What does the remediation timeline look like?

Two citation notes, because both are commonly got wrong. The 45-day clock runs from the final determination, not the initial one. And the 90-day rule is not in 252.242-7005 at all — it lives in DFARS 242.7000(d)(3), and it is not a penalty for a contracting officer missing a deadline. The regulation says that within 90 days of the contractor’s notification that it has corrected the material weaknesses, the contracting officer must either make a determination or reduce the withholding by at least 50 percent. Either/or, not a sanction.

How should employees record time daily?

The controls below are what auditors test against criteria (c)(9) and (c)(10). None is a separate clause; each is a way of demonstrating that labor is identified by cost objective and charged correctly.

Most of these end up expressed in a weekly timesheet of one kind or another; what matters is not the format but whether each control can be evidenced.

Two things DCAA does not actually say

“Total time accounting” — The phrase does not appear in any reachable DCAA document. DCAA states the substance as “recording all hours worked whether they are paid or not” and “include all hours worked including uncompensated overtime”.

“Timesheets must be completed in ink” — No DCAA source reached says this. The closest published language is an instruction to auditors to look for “corrections, alterations, whiteouts” — a detection technique, not a rule about pens.

How must corrections be documented?

DCAA’s published guidance for contractors — DCAA Manual 7641.90, Information for Contractors, at Enclosure 2, paragraph 4, Labor Charging System, which is where the timekeeping material actually lives — asks a correction to identify three things:

• the original time charge
• the corrected time charge
• documentation from the employee indicating his/her concurrence with the change

The third is the one template policies miss. It is not enough that a supervisor signs off a change; the guidance asks for documentation from the employee indicating concurrence in it. A correction made to someone’s timesheet without their agreement on the record is the gap an auditor is looking for.

The same guidance is blunt about who may fill in a timesheet: “The supervisor is prohibited from completing an employee’s timesheet unless the employee is absent for a prolonged period of time on some form of authorized leave.”

Overwriting an entry destroys the first element. A system that stores only the current value cannot show an auditor what was originally recorded, and the absence of the prior value is itself the finding — there is nothing against which to test the explanation. The same applies to corrections made after a period closes: the correction is permissible, the silent correction is not.

Is any software DCAA-approved?

No, and DCAA says so itself. From its own briefing for contractors entering the market: “There is no such thing as a DCAA approved government accounting system.” The same document explains why: “An accounting system is more than just a software package”, and “Many accounting software application can be part of an acceptable accounting system or set up in a manner that fails to meet the requirements of an acceptable system.”

That last sentence is the whole answer. The same product can be part of an acceptable system or configured into an unacceptable one, so adequacy is a property of the contractor’s configuration, policies and controls — never of the product. A vendor cannot hold a status the agency does not issue.

What is audited is the contractor’s system in the broad sense the regulation uses. DFARS 252.242-7006(a) defines an accounting system as “the Contractor’s system or systems for accounting methods, procedures, and controls established to gather, record, classify, analyze, summarize, interpret, and present accurate and timely financial data for reporting in compliance with applicable laws, regulations, and management decisions, and may include subsystems for specific areas such as indirect and other direct costs, compensation, billing, labor, and general information technology”. Software is one component of that. The policies written around it, the training, the access separation and the supervisor review are the rest.

The useful question about a product is therefore not whether it is compliant but whether it supports the specific controls an auditor tests: same-day entry, charging to cost objectives, complete capture of hours worked, an edit history that preserves the prior value and records the employee’s concurrence, segregated access rights, and approval records that survive the retention period. A time clock that cannot show what an entry said before it was changed fails the last of those whatever else it does.

Monitask records time as it happens, assigns every entry to a project or task, and keeps an edit history showing who changed what and when — the controls behind criteria (c)(9) and (c)(10).
See how time tracking works in Monitask

Sources

• DFARS 252.242-7006, Accounting System Administration (JAN 2025)
• DFARS 252.242-7005, Contractor Business Systems (JAN 2025)
• DFARS Subpart 242.70, Contractor Business Systems
• FAR Subpart 4.7, Contractor Records Retention
• FAR 15.209, Solicitation provisions and contract clauses
• DCAA, “Common DCAA Audits: Floor Checks and Material Cost Audits”, 1 November 2021
• DCAA Master Audit Program 13500, Major Contractors Labor Floorchecks or Interviews_1.pdf)
• DCAA, “From a DCAA Perspective: Breaking Into GovCon”
• DCAA, “Accounting System Requirements — Pre-Awards”
• Federal Register, DFARS final rule implementing section 806 of Pub. L. 116-283, 17 January 2025
• FAR Part 31, Contract Cost Principles and Procedures; FAR Subpart 9.4, Debarment, Suspension, and Ineligibility
• DCAA Manual 7641.90, Information for Contractors, Enclosure 2, paragraph 4, Labor Charging System