‹ Suite DCAA Compliance Crosswalk · v1.0

Passing a DCAA audit — what's true today, what has to happen

The same discipline as the PMBOK and FAR/DFARS crosswalks: every requirement cited to its public authority, mapped to where this suite implements it, with the gap stated plainly. DCAA does not certify software — it audits the contractor's accounting system and practices (the SF 1408 pre-award survey and DFARS 252.242-7006 criteria). A tool can make you auditable; only your operating discipline passes the audit.

Why this prototype is not an authoritative record — the straight answer

State lives in mutable browser localStorage on one machine: no server timestamps, no access control, no append-only history, no retention guarantee (FAR Subpart 4.7 requires records kept ~3 years after final payment), and anyone at the keyboard can edit anything. An auditor needs records that cannot be silently altered. The math is already audit-grade — traceable, recomputable, exact to $0.001 — the record-keeping layer is what's missing, and that is a deployment build, not a redesign.

The crosswalk

STATUS: LIVE = working in the suite now · PRACTICE = procedural, your team must operate it · DEPLOY = requires the production backend

Requirement	Authority	Status	Where / what has to happen
Segregate direct vs. indirect costs	SF 1408 §2(a) · FAR 31.202/31.203	PARTIAL	Direct cost capture is LIVE (labor by person/LCAT, ODC, travel, training on separate lines). Indirect pools (fringe/OH/G&A rate structure) are DEPLOY — the wrap rate must decompose into auditable pools.
Accumulate costs by contract / job (labor distribution)	SF 1408 §2(b),(d)	LIVE	Hours → person → labor category → program → invoice line is one unbroken chain in the Resource Center; the per-person invoice detail is the labor-distribution report.
Timekeeping: employee-entered, by job, daily	SF 1408 §2(e) · DCAA timekeeping guidance	DEPLOY	Monthly grid is LIVE; DCAA expects each employee to record their own time daily with reason-coded corrections. Needs per-user login + daily entry + employee attestation.
Audit trail on time changes	DCAA timekeeping guidance	LIVE	New: every timesheet cell change is logged with timestamp, resource, and old → new value (Timesheet tab). DEPLOY hardens it to an append-only server log.
Supervisor approval of time	DCAA timekeeping guidance	PRACTICE	The Stage Gates signature pattern is the mechanism; wiring a monthly timesheet-approval gate (PM signs each period) + n8n notification is the planned build.
Exclude unallowable costs	SF 1408 §2(f) · FAR 31.205	DEPLOY	Needs an unallowables screen on cost elements (FAR 31.205 list: entertainment, interest, lobbying, etc.) flagged at entry and excluded from billing rates.
Billings reconcile to the books	FAR 52.216-7 · SF 1408 §2(h)	PARTIAL	Invoice math is LIVE and recomputable from hours × rates + ODC + travel + fee. "The books" it must reconcile to is the DEPLOY backend (or your accounting system via export).
Limitation of funds / cost notices	FAR 52.232-22 / 52.232-20	LIVE	Funded-vs-burn tracking with the 75% notice discipline is in BidSummary, Resource Center, and the SubK agreement form.
Interim rate monitoring / indirect submissions	FAR 52.216-7(d) · DCAA ICE model	DEPLOY	Annual incurred-cost submission (ICE schedules) generated from the same data once indirect pools exist.
Record retention & integrity	FAR Subpart 4.7	DEPLOY	Postgres system of record, append-only audit log, role-based access, backups, ~3-year post-final-payment retention. This is THE gap between "demo" and "authoritative record."
Accounting system in full operation	SF 1408 §1 · DFARS 252.242-7006	PRACTICE	DCAA audits operating history, not intentions: months of real timesheets, approvals, invoices, and reconciliations produced by this system, on the record.

What has to happen — in order

System of record: move state from localStorage to Postgres with an append-only audit log and server timestamps.
Identity: per-user login with roles (employee / supervisor / admin) — employees enter only their own time.
Daily timekeeping: daily entry screens, employee attestation at period close, reason-coded corrections (the audit trail already exists).
Approvals: monthly timesheet gate signed by the PM (Stage Gates pattern) with n8n notifications to owners.
Indirect structure: decompose wrap into fringe/OH/G&A pools; add the FAR 31.205 unallowables screen.
Operate it: run real periods through the system, then mock the SF 1408 pre-award survey against your own records before DCAA ever does.

Sources

SF Form 1408 — Preaward Survey of Prospective Contractor Accounting System (GSA forms library)
DFARS 252.242-7006 — Accounting System Administration (18 system criteria) · eCFR Title 48
FAR Part 31 — Contract Cost Principles (31.201-2 documentation; 31.202/31.203 direct/indirect; 31.205 unallowables)
FAR 52.216-7 Allowable Cost & Payment · FAR 52.232-20/22 Limitation of Cost/Funds · FAR Subpart 4.7 records retention
DCAA Information for Contractors (DCAAM 7641.90) — timekeeping and labor-charging guidance; DCAA ICE model for incurred-cost submissions

Clause text verified against eCFR at use — never quoted from memory. Not legal or audit advice; engage a DCAA-experienced accountant before a real audit.