Accounting Systems and DCAA Audits for Software Companies: When Cost Rules Apply

2026-10-27#saas #federal-market

By Philip Luca — Founder of GovExpress; prior domain experience at Bloomberg Government and GovWin IQ.

Most software companies sell to the government the way they sell to everyone else: a subscription or license at a fixed price. The government pays the price on the invoice, and nobody asks what it cost you to build the product. That changes when you take work where the price depends on your costs or your hours. Then the government needs to trust your books, and an auditor will test them.

This guide covers when accounting system rules apply to a software company, what “adequate” means, who audits, which costs the government will not reimburse, how indirect rates and incurred cost submissions work, and where the Cost Accounting Standards come in. It is written for founders and finance leads who have only ever kept commercial books.

When the rules apply

The contract type decides. Our guide to federal contract types covers each one; for accounting purposes they fall into three groups.

Firm-fixed-price. The default for licenses and subscriptions. FAR 12.207 directs agencies to use firm-fixed-price or fixed-price with economic price adjustment when buying commercial products and services, so most SaaS sales land here. Your costs are not audited to set payment. Commercial books are enough.
Time-and-materials and labor-hour. The government pays fixed hourly rates for hours actually worked. You need records that show who worked, on which contract, for how many hours. Under FAR 52.232-7 the government can audit the hours you bill, so timesheets have to hold up.
Cost-reimbursement. The government reimburses allowable costs plus a fee. FAR 16.301-3 allows this type only when your accounting system is adequate for determining costs applicable to the contract. If it is not, you cannot receive the award.

Software companies usually meet the third group through research and development work: some SBIR awards, especially larger Phase II awards at some agencies, are cost-plus-fixed-fee. See SBIR and STTR for software companies for how those programs work.

What “adequate” means

There is no single certified product. Adequacy is judged against criteria, and the government’s preaward survey form, SF 1408, lists them. In general terms, an adequate system:

Segregates direct costs from indirect costs, so engineering hours on a contract are kept apart from sales, marketing and administration.
Accumulates direct costs by contract, with each cost-type contract set up as its own cost objective.
Allocates indirect costs logically and consistently, using defined pools and bases rather than a judgment call each month.
Keeps costs under general ledger control, so job cost detail reconciles to the books.
Records labor through timekeeping that ties each employee’s hours to the contract or indirect activity they worked on, recorded as the work happens rather than reconstructed later.
Identifies and excludes unallowable costs from anything billed to the government.
Posts costs to contracts at least monthly, so billings and reports can be supported at any point.

General-purpose small-business accounting software can be set up to meet these criteria, and there are also accounting products built for government contractors. The software matters less than the setup: a chart of accounts with direct and indirect pools, a timekeeping policy employees follow daily, and written procedures. For how this fits the broader contractor review, see responsibility determinations.

Who audits

The Defense Contract Audit Agency (DCAA) audits contractors for the Department of War (DoW), and performs audits for many civilian agencies under reimbursable agreements. Some civilian agencies use their own auditors, inspectors general or contracted audit firms. Whoever performs it, the kinds of review are similar:

Preaward accounting system review. Before a first cost-type award, the contracting officer may request a review of whether your system is adequate. Expect questions about your chart of accounts, timekeeping, indirect rate structure and how you exclude unallowable costs.
Proposal audits. For larger cost-based proposals, the auditor may test the costs and rates you proposed.
Incurred cost audits. After the year ends, the auditor may examine the actual costs and rates you claimed.
Business system reviews. On larger DoW contracts, DFARS 252.242-7006 sets out criteria for an acceptable accounting system, and significant deficiencies can lead to withholds from payments until they are corrected.

Start preparing before you submit a cost-type proposal. A review that finds the system inadequate can delay or block the award.

Unallowable costs

FAR Part 31 sets the cost principles. A cost is allowable only if it is reasonable, allocable to the contract and not excluded by a specific rule (FAR 31.201-2). Several ordinary costs of running a software company are expressly unallowable, including:

Entertainment (FAR 31.205-14) and alcoholic beverages (FAR 31.205-51).
Most advertising (FAR 31.205-1), with narrow exceptions such as recruitment advertising.
Interest and other financing costs (FAR 31.205-20), which matters for venture-backed companies carrying debt.
Contributions and donations (FAR 31.205-8) and bad debts (FAR 31.205-3).
Lobbying and political activity (FAR 31.205-22).

Executive compensation is allowable only up to a cap and only if reasonable (FAR 31.205-6). Your own product research and development is generally treated as independent research and development, which can be allowable as an indirect cost under FAR 31.205-18 when the rules are met.

FAR 31.201-6 requires you to identify unallowable costs and exclude them from billings and rate proposals. Including expressly unallowable costs in a final indirect rate proposal can bring penalties under FAR 42.709. In practice, set up separate accounts for unallowable costs from the start, so they never mix with the pools you bill against.

Indirect rates and the incurred cost submission

On a cost-type contract you bill direct costs plus your indirect costs, spread through rates. A typical structure has a fringe rate for benefits and payroll taxes, an overhead rate for costs that support the technical work, and a general and administrative (G&A) rate for running the company. A small company may combine pools, as long as the structure is consistent and the allocation is logical.

During the year you bill using provisional billing rates set with the contracting officer or auditor under FAR 42.704. After the year ends, the Allowable Cost and Payment clause (FAR 52.216-7) requires an incurred cost submission: a proposal of your actual final indirect rates for that fiscal year, normally within six months after year end. Once final rates are settled, billings are adjusted up or down. If you bill above actual rates all year, expect to return the difference.

Two practical points. First, the incurred cost submission is due every year you have cost-type work, including years when the work is small. Second, the final rates you settle become the history auditors and contracting officers use on your next cost-type proposal. For how cost-type billing fits with invoicing systems, see federal invoicing for software companies.

The Cost Accounting Standards

The Cost Accounting Standards (CAS) are a separate, more demanding set of rules on how costs are measured, assigned to periods and allocated. They appear at 48 CFR Chapter 99 and are implemented through FAR Part 30. CAS-covered contractors may also have to file a Disclosure Statement describing their cost accounting practices.

Many software companies never meet CAS. The exemptions at 48 CFR 9903.201-1 include contracts with small businesses, contracts for commercial products and services, and firm-fixed-price contracts awarded on adequate price competition without certified cost or pricing data. Contracts below the dollar threshold in the rules are also exempt. If a large award does not fit an exemption, CAS coverage is a significant commitment, and it is worth getting advice before you accept it. For when certified cost or pricing data is required, see price reasonableness for software companies.

What this means for a software company

Know your contract types. Fixed-price commercial sales under FAR Part 12 do not bring accounting system reviews. Cost-type and, to a lesser degree, T&M work do.
Start timekeeping before you need it. Daily timesheets that tie hours to contracts and indirect activities are the most common gap for software companies, and they cannot be reconstructed after the fact.
Build the chart of accounts once. Set up direct, indirect and unallowable accounts before the first cost-type proposal, not during the preaward review.
Separate unallowable costs from day one. Entertainment, most advertising, interest and donations should never reach a billed pool.
Calendar the incurred cost submission. Six months after each fiscal year end, every year you have cost-type work.
Check CAS on large awards. Most small and commercial work is exempt, but confirm before accepting anything large.
Read the current rule text. The FAR is being rewritten under the Revolutionary FAR Overhaul, so section numbers and wording may change. Confirm the clauses in your solicitation, and involve a government contracts accountant or counsel before your first cost-type award.

Where this fits

The accounting system is one of the things a contracting officer weighs before awarding cost-type work, alongside responsibility and past performance. It also matters after award: the same cost records support claims and requests for equitable adjustment when the work changes.

Score your company’s federal readiness to see how your compliance profile looks next to the other categories federal buyers review.

Frequently Asked Questions

Does a SaaS company selling subscriptions need a DCAA-compliant accounting system?

Usually not. Commercial software and subscriptions are normally bought on firm-fixed-price terms under FAR Part 12, where the government pays the agreed price and does not audit your costs to decide what to pay. Accounting system requirements arrive when you take cost-reimbursement work, and to a lesser degree time-and-materials or labor-hour work, which are common for services, research and some SBIR awards.

What makes an accounting system adequate for a cost-reimbursement contract?

In general terms, the system has to segregate direct and indirect costs, accumulate direct costs by contract, allocate indirect costs on a logical and consistent basis, keep costs under general ledger control, record labor through a timekeeping system that ties hours to contracts, and identify and exclude unallowable costs. The government's preaward survey form, SF 1408, lists the criteria auditors look at.

What is an incurred cost submission?

On contracts with the Allowable Cost and Payment clause, FAR 52.216-7, you submit a proposal for your final indirect cost rates for each fiscal year, normally within six months after the year ends. The auditor and contracting officer use it to settle the rates you billed provisionally during the year.

Do the Cost Accounting Standards apply to small software companies?

Often not. The Cost Accounting Standards have exemptions listed at 48 CFR 9903.201-1, including contracts with small businesses, contracts for commercial products and services, and firm-fixed-price contracts awarded on adequate price competition without certified cost or pricing data. Larger contracts that do not fit an exemption can bring CAS coverage and disclosure duties, so check each award.

The CMMC brief

What the Phase 2 suspension changed and what it did not — the obligations that still bind, the assessment path a contract puts you on, the scoping decision that drives the cost, and the sequence that fits inside a pipeline. Sourced from the primary record.