How A&E Firms Build Timesheets That Pass DCAA Overhead Audits

Your firm has a timekeeping policy. Most A&E firms do. It probably says "enter time daily," and your engineers probably comply— on most days, mostly.

That gap between policy and practice is where overhead audits begin. When a Virginia-based defense contractor allowed employees to reconstruct their time allocations at the end of each week instead of recording them daily, the Defense Contract Audit Agency (DCAA) questioned $23 million in costs and suspended the firm from federal contracting for 18 months¹. The violations cited— 48 CFR 31.201-4 and Cost Accounting Standard 418— weren't obscure technicalities. They were the basic contemporaneous recording requirement.

Bradyware CPAs, which specializes in A&E overhead audits, identifies timekeeping failures as "the leading cause of audit disallowances and financial penalties"².

This article covers exactly what auditors verify when they open your timesheet system: the specific requirements, the most common failures, a compliance checklist, and where AI-assisted timekeeping tools help— and where they don't.

Why Your Timesheets Drive Your Overhead Rate

The overhead rate formula makes your timesheets a financial document— a record that determines how much indirect cost your firm can recover on every government project. According to CBH Advisory Group³, the calculation is direct: Overhead rate = total indirect expenses ÷ total direct labor cost. Every hour an employee records to a client project becomes part of the denominator. Every misclassified, reconstructed, or unrecorded hour corrupts the rate your firm submits to the government.

Most engineering firms carry a two-tier cost structure: an overhead pool (indirect costs related to project delivery) and a G&A pool (executive salaries, accounting, business development). Both divide against the direct labor base. Both depend on accurate timesheets for that base.

A&E firms billing state transportation work and those on federal defense contracts operate under the same foundational cost standard— FAR Part 31, the Federal Acquisition Regulation cost principles that define what engineering firms can bill on government contracts. The auditors differ, but the formula does not:

A&E firms billing state DOT contracts must comply with the AASHTO Uniform Audit & Accounting Guide, which interprets FAR Part 31 for state transportation contracts⁴. State DOTs conduct annual overhead rate audits⁵. Specific dollar thresholds above which a state DOT audit is required vary by state— contact your state DOT's prequalification office for the applicable threshold.

The consequence cascade runs in one direction: misclassified timesheet hours → inflated or deflated overhead rate → audit finding → disallowed costs → forced repayment⁶. Auditors know where to start. So should you.

For context on how AI governance and compliance strategy intersects with regulatory frameworks like FAR, that article covers the landscape.

Total Time Accounting— Every Hour, Not Just Billable Hours

Total time accounting requires engineering firm employees to record every hour they work— not just the hours billed to a client project. Business development meetings, training, administrative tasks, leave time, and uncompensated overtime must all appear on the timesheet, classified to the correct indirect account⁷.

This surprises firms that assumed only project-direct hours mattered. The math explains why. If engineers work uncompensated overtime but log only eight hours, the direct labor denominator understates actual time worked— which artificially inflates the overhead rate. That's exactly the anomaly auditors are trained to find.

Hours every employee must record on every timesheet:

• Direct project hours (charged to each specific contract or project number)
• Overhead time (facility costs, project management support, non-billable professional time)
• G&A time (executive functions, accounting, HR administration)
• Business development activities (client pitches, proposals, conference attendance)
• Training and professional development
• Leave: vacation, sick, holiday, and administrative leave
• Uncompensated overtime

CBH Advisory Group confirms⁸ that the daily entry requirement applies to all of these categories— not just billable work. A project engineer who stays until 9 PM to meet a DOT submission deadline but logs only eight hours has left a gap in the direct labor base that an auditor will question.

The policy may say "record all hours." The practice often doesn't. That gap is what auditors call an end-of-period reconstruction problem.

What Overhead Auditors Actually Check in Your Timesheets

An overhead auditor reviewing your timesheets is checking seven specific things: whether entries are made daily, whether all hours are recorded, whether charge codes correctly identify direct versus indirect costs, whether employees have certified their own timesheets, whether supervisors have reviewed and approved them, whether there is a complete audit trail for every change, and whether the firm has documented timekeeping training for every employee⁹.

Here is what each requirement means in practice:

1. Daily entry (contemporaneous recording). Entries must be made the day the work occurs. Reconstructed weekly timesheets violate FAR 31.201-2 and CAS 418— the same provisions cited in the $23 million Virginia case¹⁰.

1. Total time accounting. All hours must appear: direct, indirect, G&A, leave, and uncompensated overtime. (See previous section.)

1. Charge codes / cost objective identification. Each entry must identify whether it is direct (which contract or project) or indirect (which overhead category). DFARS 252.242-7006 (Defense Federal Acquisition Regulation Supplement) requires timekeeping systems to label each labor entry by cost objective¹¹.

1. Employee self-certification. The employee must certify the accuracy of their own timesheet. A supervisor cannot certify on the employee's behalf¹².

1. Supervisor active review— not rubber-stamp approval. Supervisors must "actively review timesheets for accuracy rather than automatically stamping approvals," per Bradyware CPAs¹³. The review must be documented.

1. Audit trail for every correction. Any change must document the original charge, the corrected charge, the reason for the change, who made it, and when. The employee must initiate the correction¹⁴.

1. Timekeeping training, documented. Firms must train every employee on hire and annually. CBH Advisory Group confirms that training records must be retained¹⁵.

1. Record retention. FAR Subpart 4.7 requires a minimum of three years after final payment on each contract¹⁶.

This is what auditors call "internal controls for labor charging." Firms with solid documentation on all eight points tend to pass. Firms with a good written policy but inconsistent practice tend to fail— and the DCAA floor check is precisely how auditors determine which type your firm is.

The DCAA Floor Check— When the Auditor Shows Up Unannounced

A DCAA floor check is an unannounced visit in which an auditor interviews employees directly to confirm their timesheets reflect the work being done at that moment¹⁷. The auditor is not looking at your policy manual. They are asking your staff engineer: Is your timesheet current? What did you work on this morning? Why does your timesheet show entries only through Tuesday when today is Thursday?

That mid-week scenario is more common than most firms expect. Projectworks documents the pattern directly¹⁸: "The most common gap is end-of-week reconstruction. The drift stays invisible until an auditor runs a DCAA floor check, interviews an employee mid-week, and finds a timesheet three days behind." That's the gap between the daily-entry policy in the employee handbook and the Friday-batch reality on the server.

Three things every employee must know before a DCAA floor check:

• Enter time the same day work is performed. There is no allowable grace period under FAR.
• Know your charge codes. Employees must be able to explain each entry and why it's classified direct or indirect.
• Don't let a supervisor fill in your timesheet. If a supervisor created entries for an employee, the firm has an internal controls failure regardless of whether the hours are accurate.

Floor checks are specific to DCAA (federal/defense contractors). State DOT auditors use different mechanisms, but the same daily-entry standard applies under FAR Part 31.

Beyond Timesheets— The Five Overhead Cost Traps

Even firms with spotless timesheets can fail an overhead audit if their indirect cost pool contains expenses FAR Part 31 explicitly prohibits. Five cost categories account for the majority of overhead disallowances at A&E firms¹⁹. The FAR citation in each row is the provision under which auditors challenge the cost— and the "Common Firm Mistake" column is where most firms inadvertently create exposure.

CliftonLarsonAllen (CLA) identifies additional disallowables that frequently appear in overhead pools: employee appreciation events, charitable contributions, owner personal-vehicle use, and advertising that doesn't meet the recruiting or scrap-disposal exception²⁰.

One specific note on executive compensation: the DoD updates the BCA annually. Filing a rate certification with the prior year's BCA ceiling exposes the firm to questioned costs on a line item the rate itself introduced. Check the current-year limit on the DoD procurement website before filing— a ten-minute check prevents a disallowance.

How AI and Automation Change the Compliance Equation

AI is changing timesheet compliance for engineering firms in one specific way: it can automate the reminders, pre-fill entries from calendar or email data, flag missing hours, and generate the audit trail documentation that used to require manual effort. What AI cannot do is replace the employee's obligation to review, correct, and certify their own time.

Deltek Costpoint— a project-based ERP used by federal contractors— has embedded Dela, an AI orchestrator that simplifies compliant time entry for government contractors²¹. Unanet, a GovCon project management platform, has built AI capabilities for compliant time entry and workflow guidance²². Both automate reminders, surface compliance gaps, and reduce the friction of daily entry.

The automation is real and worth having. Auditors, though, examine the controls layer— the employee behaviors and documentation the software is built on top of.

What AI-enhanced timekeeping can automate:

• Daily entry reminders to employees who haven't submitted hours
• Pre-population of charge codes from calendar events or recent project activity
• Flags when an employee's total recorded time is below expected hours for the period
• Audit trail documentation for corrections, automatically timestamped

What AI cannot replace:

• The employee's review of pre-filled entries for accuracy
• The employee's self-certification that the timesheet is complete and correct
• The supervisor's active review and documented approval
• A firm's written timekeeping policy and annual training program

As Unanet states directly: "DCAA does not certify software; the system of controls must be compliant."²²

Most A&E firms looking for DCAA-compliant timekeeping software are solving the wrong problem first. What they need before selecting any platform is a decision about who owns the daily timesheet entry process— because no software configuration fixes the behavior gap when engineers reconstruct time at week's end. The technology is the enabler; the employee remains the responsible party.

For firms evaluating AI implementation for professional services firms, or considering automating compliance workflows, the process-ownership decision should come before the software selection. And for those working on building an AI-ready culture across your firm, the daily discipline that produces compliant timesheets is the same discipline that produces effective AI adoption— the two reinforce each other.

If mapping the right compliance tools to your firm's specific billing structure and project mix feels like a full-time job on its own, a technology implementation partner can accelerate that work considerably.

Your Overhead Audit Readiness Checklist

Before an overhead auditor reviews your timesheets, your firm should be able to answer yes to each item below. Any "no" is an audit risk— and a correctable one.

Timekeeping Policy and Practice:

1. Does your timekeeping policy require daily entry? Is the policy in writing and current?
2. Does your system record ALL employee hours— direct, overhead, G&A, leave, uncompensated overtime?²³
3. Do employees know their charge codes and how to classify direct versus indirect hours?
4. Are timesheets current as of today? Not reconstructed on Friday. Not three days behind.⁸

Approvals and Audit Trail:

1. Does every timesheet have employee self-certification?⁸
2. Does every timesheet have documented supervisor review and approval— not just a rubber-stamp?¹³
3. Does your system maintain a complete audit trail for every change: what changed, why, who made it, when?¹⁴
4. Can supervisors NOT create or complete entries for employees?⁸

Training and Retention:

1. Have all employees been trained on timekeeping requirements at hire? Annually?¹⁵
2. Are training records retained?¹⁵
3. Are all timesheet records retained for a minimum of three years after final payment on each contract?¹⁶

Indirect Cost Pool Hygiene:

1. Have you reviewed your overhead pool for the five disallowable cost categories covered in the previous section?
2. Is executive compensation reviewed annually against the current BCA under FAR 31.205-6(p)?

FAQ

A&E firm principals and financial officers ask these questions most often about timesheet compliance and overhead audits.

Is weekly timesheet entry acceptable under FAR?

No. FAR requires contemporaneous recording of time. Weekly reconstruction— entering the whole week's hours on Friday— has been cited in regulatory cases resulting in $23 million in questioned costs and an 18-month contract suspension, under violations including 48 CFR 31.201-4 and CAS 418¹⁰. The requirement is daily entry. Enforcement scrutiny varies by contract type and agency, but the legal exposure from weekly reconstruction is well-documented.

What does a DCAA floor check look for specifically?

Auditors interview employees directly to confirm timesheets are current and reflect actual work being performed at that moment¹⁷. The most common finding is a timesheet several days behind when the auditor arrives mid-week¹⁸. Failing a floor check can lead to financial penalties, contract loss, and a negative audit reputation that follows the firm through future procurements.

Can a supervisor complete or edit an employee's timesheet?

No. Employees must initiate all timesheet entries and corrections. Supervisors cannot create entries on behalf of employees. Supervisors must actively review and approve— and all corrections must document what changed, why, who made the change, and when⁸¹³¹⁴.

What software is DCAA compliant?

DCAA does not certify or approve specific software products²². Compliance depends on the system of controls: daily entry policy, audit trail, proper approvals, charge code accuracy. Deltek Costpoint and Unanet are widely used platforms for government contractors, but any time-entry system configured to meet the required controls can satisfy the standard. Compliant timekeeping does not require enterprise ERP— a well-documented policy plus any time-tracking software with a proper audit trail can meet the standard for smaller firms.

How long must engineering firms retain timesheet records?

FAR Subpart 4.7 requires a minimum of three years after final payment on each contract¹⁶, subject to contract-specific terms that may extend this period.

What the Audit Really Starts With

Timesheet compliance for engineering firms isn't a back-office problem. Every entry decision your employees make— daily versus Friday, direct versus indirect, certified versus approved-by-default— compounds across every contract and every audit cycle. The firms that pass overhead audits are the ones that treat their timekeeping system as a live financial control, not a policy document last updated during a prior audit.

The technology is improving. AI-assisted platforms can automate the reminders and reduce the friction of daily entry. But the requirement hasn't changed: each employee reviews and certifies their own time. That's where the audit starts. And that's where the consequence cascade either stops or begins.

If you're not certain your firm could answer yes to every item in the checklist above, that's the right place to start.

References

1. Hour Timesheet, "The $23 Million Timekeeping Mistake: Why DCAA Rejected Weekly Time Entry Systems" (2025)— https://www.hourtimesheet.com/?p=12891
2. Bradyware CPAs, "Q&A: AASHTO Timekeeping Compliance" (2024)— https://bradyware.com/qa-aashto-timekeeping-compliance/
3. CBH Advisory Group, "FAR Overhead Calculations for A/E Firms" (2024)— https://www.cbh.com/insights/articles/far-overhead-calculations-for-a-e-firms/
4. Bradyware CPAs, "AASHTO & FAR Overhead Rate Audit" (2024)— https://bradyware.com/audit-assurance/ae-far-aashto-overhead-rate-audit/
5. Wiss & Company, "Maintaining FAR Compliance of Overhead Rates for Engineering Firms" (2024)— https://wiss.com/maintaining-far-compliance-of-overhead-rates-for-engineering-firms/
6. Bradyware CPAs, "Q&A: AASHTO Timekeeping Compliance" (2024)— https://bradyware.com/qa-aashto-timekeeping-compliance/
7. Bradyware CPAs, "Q&A: AASHTO Timekeeping Compliance" (2024)— https://bradyware.com/qa-aashto-timekeeping-compliance/
8. CBH Advisory Group, "DCAA Timekeeping Requirements for Government Contractors" (2024)— https://www.cbh.com/insights/articles/dcaa-timekeeping-requirements-for-government-contractors/
9. CBH Advisory Group, "DCAA Timekeeping Requirements for Government Contractors" (2024)— https://www.cbh.com/insights/articles/dcaa-timekeeping-requirements-for-government-contractors/
10. Hour Timesheet, "The $23 Million Timekeeping Mistake: Why DCAA Rejected Weekly Time Entry Systems" (2025)— https://www.hourtimesheet.com/?p=12891
11. CBH Advisory Group, "DCAA Timekeeping Requirements for Government Contractors" (2024)— https://www.cbh.com/insights/articles/dcaa-timekeeping-requirements-for-government-contractors/
12. CBH Advisory Group, "DCAA Timekeeping Requirements for Government Contractors" (2024)— https://www.cbh.com/insights/articles/dcaa-timekeeping-requirements-for-government-contractors/
13. Bradyware CPAs, "Q&A: AASHTO Timekeeping Compliance" (2024)— https://bradyware.com/qa-aashto-timekeeping-compliance/
14. CBH Advisory Group, "DCAA Timekeeping Requirements for Government Contractors" (2024)— https://www.cbh.com/insights/articles/dcaa-timekeeping-requirements-for-government-contractors/
15. CBH Advisory Group, "DCAA Timekeeping Requirements for Government Contractors" (2024)— https://www.cbh.com/insights/articles/dcaa-timekeeping-requirements-for-government-contractors/
16. CBH Advisory Group, "DCAA Timekeeping Requirements for Government Contractors" (2024)— https://www.cbh.com/insights/articles/dcaa-timekeeping-requirements-for-government-contractors/
17. Projectworks, "What is a DCAA Floor Check? A Guide for New Government Contractors" (2024)— https://www.projectworks.com/blog/dcaa-floor-check-explained
18. Projectworks, "What is a DCAA Floor Check? A Guide for New Government Contractors" (2024)— https://www.projectworks.com/blog/dcaa-floor-check-explained
19. Bradyware CPAs, "5 Common Unallowable Costs Threatening Your Overhead Rate" (2024)— https://bradyware.com/5-common-unallowable-costs-threatening-your-overhead-rate/
20. CliftonLarsonAllen (CLA), "Overhead Audits— Key Strategies to Help You Prepare" (2025)— https://www.claconnect.com/en/resources/articles/25/overhead-audits-key-strategies-to-help-you-prepare
21. Deltek, "Deltek Costpoint Brings Expanded AI Capabilities" (2025)— https://www.deltek.com/resources/articles/deltek-costpoint-brings-expanded-ai-capabilities/
22. Unanet, "DCAA Timekeeping Requirements and Timesheet Software" (2024)— https://unanet.com/blog/dcaa-timekeeping-requirements-and-timesheet-software
23. Bradyware CPAs, "Q&A: AASHTO Timekeeping Compliance" (2024)— https://bradyware.com/qa-aashto-timekeeping-compliance/