Small companies hear the word audit and picture inspectors in the conference room. The realistic picture is narrower: most SBIR recipients at grant-making agencies never see a Defense Contract Audit Agency auditor at all, while a company on a defense contract award may deal with one directly. Knowing which situation you are in tells you how much to prepare. This is general information, not accounting or legal advice.

Who audits what

DCAA provides audit services primarily for the Department of Defense and, on request, for some other agencies. Its work concerns contracts. If your award is a grant from NIH, NSF, DOE, or a similar agency, your oversight normally runs through the agency's own grants management staff and, above certain federal spending thresholds, through a single audit performed by an independent auditor under Uniform Guidance. Those thresholds are set federally and change over time, so check the current figure rather than relying on a number you read somewhere. Which agency you chose therefore has downstream consequences, which is one more reason the agency decision deserves thought at proposal time.

Accounting system review versus incurred cost audit

These get confused constantly and they are not the same thing.

  • An accounting system review asks whether your system is capable of accumulating and reporting costs properly. It looks at structure: segregation of direct and indirect costs, job cost tracking, timekeeping, exclusion of unallowable costs. It usually happens before or early in a cost-reimbursement contract, and the underlying requirements are the same ones behind the award management basics every recipient should know.
  • An incurred cost audit asks whether the specific costs you actually claimed were allowable, allocable, and reasonable. It looks backward at real transactions, typically after a period of performance, and mainly applies to cost-reimbursement contracts.

A firm fixed price award paid against completed milestones generally does not put you through incurred cost review the way a cost-reimbursement contract does, though other requirements still apply. Ask your contracting officer which regime governs your award rather than assuming.

What to keep, and for how long

Readiness is mostly a records question. Keep daily timesheets with employee and supervisor approval, payroll records tying to those timesheets, invoices and receipts for every direct cost, subcontract agreements and the subcontractor's invoices, your indirect rate calculation with the ledger data behind it, and written approvals for anything the agency agreed to along the way. Keep the correspondence too, because a program officer's email approving a change is evidence and a memory is not. Retention periods are set by the award terms and generally run for years after final payment.

The habit that makes all of this cheap is doing it monthly. A company that reconciles project costs each month and files approvals as it receives them can respond to an audit request in days. A company that reconstructs a year of records under deadline pressure will find gaps, and gaps become questioned costs. If your books are not there yet, fix the structure before the money starts moving, the same way you would fix a flawed budget before submitting it.

Projects House works with award recipients whose engineering spend has to survive later review. Bring us your project plan through the contact form.