DCAA-Style Timekeeping, The Discipline That Survives an Audit
Pull-quote: “An auditor does not ask whether your timesheet is correct. They ask whether your process makes an incorrect timesheet hard to produce and easy to catch.”
Why this matters
On most government contracts, labor is the largest cost the government reimburses, and it is the one cost with no receipt. There is no invoice for an hour of an engineer’s attention. The timekeeping record is the receipt, which is why timekeeping is the first discipline a DCAA-style review tests, and the fastest way for a growing contractor to lose credibility. The test is not arithmetic. Auditors assume your spreadsheet can add. They test whether the process behind the numbers makes bad records hard to create and easy to detect.
The three mechanics
Timekeeping guidance reduces to three mechanical properties. Everything else, the policy document, the training, the reminders, exists to support them.
| Mechanic | What it means in practice | The failure it prevents |
|---|---|---|
| Daily records | Each employee records their own time, every working day, at the charge-code level | Friday reconstruction from memory, which is estimation, not recording |
| Approval workflow | A supervisor reviews and approves each period, and the approval itself is recorded | Time that no one accountable ever looked at |
| Change trail | Every correction preserves the original entry, the new value, who changed it, when, and why | Silent edits that make the record unreviewable |
The third column is the audit. A reviewer who can trace any hour from entry through approval through every later correction has very little left to question. A reviewer who cannot will widen the sample, and the review gets longer and more expensive from there.
The lifecycle of a defensible hour
Entry Approval Correction
───── ──────── ──────────
Employee records ──► Supervisor reviews ──► Original preserved
own time, daily and approves + new value
charge-code level (approval logged) + who, when, reason
│ │ │
▼ ▼ ▼
┌────────────────────────────────────────────────────┐
│ One continuous, reviewable change trail │
└────────────────────────────────────────────────────┘The pattern to notice: no step destroys information. Entry creates the record, approval adds accountability, and correction appends rather than overwrites.
Where spreadsheets fail
Spreadsheets fail all three mechanics, quietly. Batch entry at the end of the week is invisible; nothing in the file shows when the hours were actually recorded. Approval is an email sitting beside the file, if it exists at all. And edits are destructive by default: the cell now reads six where it read eight, and no trace remains of the change or the reason for it. None of this means anyone acted in bad faith. It means the tool cannot prove that they did not, and in an audit, what you cannot prove might as well not have happened.
The floor check reality
The clearest expression of the process focus is the floor check: unannounced interviews in which a reviewer asks employees directly how they record their time, whether they do it daily, who approves it, and how corrections are made. Employees answer from habit, not from the policy binder. If the honest answer is that the spreadsheet gets filled in on Friday, the policy document does not matter. That is the point worth internalizing: timekeeping compliance is not a document you produce. It is a behavior your systems either enforce or quietly permit.
Built in, not bolted on
The practical test for any timekeeping system, bought or built, is whether it enforces the three mechanics instead of merely permitting them. Daily capture should be the path of least resistance, with entry dates recorded so batch entry is visible when it happens. Approvals should live inside the record rather than in an email beside it, so a reviewer can see who signed off and when. Corrections should append rather than overwrite, preserving the original value, the new value, the actor, the timestamp, and the reason, which is the shape DCAA guidance expects. Keep the supporting evidence close as well: the timekeeping policy, the training records showing employees read it, and the time records themselves tend to be requested together, and producing them together is far easier when they are maintained together.
Closing
Timekeeping discipline is cheap to run and expensive to retrofit. Daily records, enforced approvals, and an append-style change trail cost minutes a day. Reconstructing eighteen months of labor records under audit pressure costs weeks, plus credibility that does not come back. Build the discipline before anyone asks to see it.