DCAA-Compliant Timekeeping for Small Defense Contractors (Without Deltek)

The thing nobody tells you about DCAA timekeeping

There is no list of "DCAA-approved timekeeping software." DCAA does not certify products. Vendors who advertise themselves as "DCAA-approved" or "DCAA-compliant" are using marketing language — what they actually mean is "our system can be configured in a way that helps you pass an audit." Every system can also be configured in a way that fails. The compliance lives in your process, not in the box you bought.

Once you internalize that, the question stops being "which product is approved?" and starts being "what does my process need to do, and which tools support it cheaply?"

What DCAA actually wants to see

DCAA's expectations come primarily from the Contractor Business Systems framework (DFARS 252.242-7006) for accounting systems, and the broader Information for Contractors guidance (DCAA pamphlet 7641.90). Distilled to the small-contractor level, an auditor wants to confirm:

Every employee enters their own time, daily. Not weekly, not at the end of the pay period, not by their assistant. Each person, each day, in their own login.
Time is charged to a specific authorized cost objective. A WBS code, project number, or charge code that's tied to a real contract or indirect category. Not "office work" or "various."
Changes are tracked. If an entry is corrected, the original value, the new value, the reason, the date of change, and the person who made it must all be preserved. The auditor cannot accept a system that silently overwrites history.
Supervisor review and approval before payroll. Each timesheet is reviewed and approved by someone with knowledge of the work performed.
No future-dated entries. An employee cannot pre-record time they haven't worked yet.
Total time accounting. Every hour an employee works gets recorded somewhere — direct labor, indirect, leave. You don't get to ignore unpaid overtime; it has to land on a charge code so the labor distribution is honest.
The system the employee enters time in is the system used to drive payroll and billing. If your bookkeeper retypes timesheets into QuickBooks from screenshots, the audit trail is broken.

The audit findings that sink small contractors

From floor-check audits and post-award compliance reviews, the same patterns repeat. None of these require a $100K timekeeping system to avoid — just a process and the discipline to follow it.

Mass timesheet entry by managers or admins

The single most common failed audit. Manager fills out everyone's hours from memory because the team forgot. Easy to spot in any system with login auditing — if the same user account stamped 12 timesheets in 90 seconds, that's a finding.

"Someday I'll fix the WBS"

Time charged to a generic project code instead of the proper work breakdown element. Fine in your head; not fine in an indirect rate audit, where DCAA recomputes your overhead pool and finds your direct labor was misclassified.

Silent edits

Spreadsheet timesheets where Friday's row got "fixed" the following Tuesday with no record of the original. Even if the edit was legitimate, the audit trail has to show that it happened.

Mismatch between the timekeeping system and what hit the invoice

Employee logged 38 hours; the invoice billed 40. There's a five-step game of telephone between the timekeeping system, payroll, the GL, and the invoice. If that path can't be reconstructed end-to-end, it's a finding.

Tools that satisfy these requirements at small-business scale

Three tiers, in order of contract size and complexity:

Tier 1 — Up to ~$2M revenue, <10 employees

You can get fully compliant with one of these for under $20/user/month:

Hour Timesheet — built specifically for DCAA-driven contractors. Handles charge codes, audit trails, supervisor approval out of the box. The cheapest path to "obviously compliant." Around $9–15/user/month.
QuickBooks Time (formerly TSheets) — not GovCon-specific, but supports the audit trail, daily entry, supervisor approval, and locked-after-approval that DCAA cares about. Configure it carefully and document your config. Tighter integration with QuickBooks if that's your accounting system.
Replicon — more expensive but flexible; works for hybrid commercial + GovCon shops.

Tier 2 — $2M–$15M, multiple active contracts

You need real charge-code hierarchies, indirect rate buckets, and tighter accounting integration:

Unanet GovCon — widely used by mid-sized DoD contractors. Project accounting + timekeeping + reporting. Real money but real capability.
Procas — designed for small-to-mid GovCon shops. Often lighter-weight than Unanet for early-stage growth.
JAMIS Prime — another GovCon-native option.

Tier 3 — $15M+ or approaching EVMS validation

Now you're in Deltek Costpoint territory, or building something custom that integrates with your existing accounting stack. The price tag jumps an order of magnitude. By this point you have a controller and an external GovCon accounting consultant; let them lead the selection.

The homegrown trap

Some small contractors try to roll their own timekeeping in Google Sheets, Notion, or a custom internal app. This can work, but it almost never does. The four hard requirements that homegrown systems consistently fail:

Tamper-evident audit trail. A spreadsheet history log doesn't count. Each edit needs an immutable record of who/when/what-changed/why.
Authentication that's actually individual. Shared Google accounts or one Notion workspace login fails the "each employee enters their own time" test.
Supervisor approval workflow. Not "PM said it looked fine in Slack." A formal approval state, recorded.
Locking after approval. Once approved, an employee cannot edit. Only an authorized supervisor with a documented reason can re-open.

If you can satisfy all four with a custom build, great — you've effectively built a small piece of timekeeping software. Most attempts only solve two or three.

The 30-minute readiness check

If a DCAA auditor showed up tomorrow and asked to see your timekeeping system, could you answer these questions in 30 minutes?

Show me last week's timesheet for any employee — entered by whom, approved by whom, when?
Show me the audit log of any changes made to that timesheet.
Show me how time charged to Contract X this month rolls up into the labor cost on the May invoice.
What controls prevent an employee from entering tomorrow's time today?
What's your written timekeeping policy, and when was each employee trained on it?

If any of those takes longer than five minutes to demonstrate, that's where to focus first. The fix is usually process and documentation, not new software.

The boring part nobody talks about

The biggest single thing that distinguishes "passes audit" from "fails audit" isn't the software — it's whether you have a written timekeeping policy that every employee has read and signed, plus annual refresher training. That document is the first thing the auditor asks for. It costs nothing to produce and it's the foundation everything else sits on. If yours doesn't exist, write it before you shop for new software.

Need a hand?

If you're staring at a renewal quote from a GovCon timekeeping vendor and wondering whether you really need that whole platform — or you're growing fast enough that a homegrown setup is starting to scare your accountant — we offer free 30-minute teardown calls for small Defense contractors. Bring your current setup; we'll tell you whether to keep, change, or build.

Book a teardown

FAQ

Is there an official list of DCAA-approved timekeeping systems?

No. DCAA does not certify or pre-approve commercial software. They evaluate the contractor's overall business system — people, process, and software together. Any vendor claiming "DCAA approval" is using marketing shorthand. What matters at audit is whether your configuration and practices meet the requirements, regardless of what brand sticker is on the system.

Do I really need timekeeping software if all my contracts are firm-fixed-price (FFP)?

You still need accurate labor distribution to compute your indirect rates, which apply to FFP cost proposals and to any cost-type or T&M work you take on later. If you're 100% FFP today and never plan to bid anything else, the audit risk is lower — but the moment you bid a cost-reimbursement contract, prior-year labor records become directly relevant. Most growing contractors regret deferring this.

Can I let employees fill out paper timesheets and have someone enter them?

Strongly discouraged. The "each employee enters their own time" requirement assumes the employee is the person of record for the entry. Paper-then-typed creates a transcription gap that auditors flag. If you absolutely must use paper as a backup (e.g., field work without internet), have the employee enter their own time into the system retroactively the next business day — with a documented reason for the delay.

What about salaried exempt employees? Do they really need to track every hour?

Yes, for total time accounting. Even on cost-type work where only 40 hours are billable, an exempt employee who works 50 needs to record all 50 — with the hours over 40 charged to an appropriate indirect or unbilled-direct code. This is the area small contractors most often get wrong, and it directly affects your indirect cost rate calculations.

How long do I need to retain timekeeping records?

Generally three years after final payment on the contract, per FAR 4.703 retention requirements. For records tied to indirect rate proposals, retention is until DCAA settles the rate — which for many small contractors means 5–7 years in practice. Cloud timekeeping vendors usually handle this automatically; check the retention setting before assuming.