What DCAA expects from a timekeeping system
DCAA evaluates whether a contractor's labour-charging system and day-to-day controls create reliable records. A product label is not the control: the strongest process makes employees responsible for recording their own time, records changes without erasing history, and gives managers a clear approval trail.
That means software alone is not the control. Written policy, training, supervision and evidence all matter. Your system should make the correct behaviour easy and make silent retroactive changes difficult.
- Employees record time at least daily and charge every hour worked.
- Only authorised project, contract and indirect charge codes are available.
- Corrections preserve the original entry, reason, actor and timestamp.
- Supervisors review and approve complete periods promptly.
- The organisation can produce labour distribution and audit evidence.
The controls to configure first
Start with the controls that shape everyday behaviour: expected hours, daily reminders, authorised charge codes, employee certification and supervisor approval. Then add locked periods and formal corrections once the team understands the workflow.
A staged rollout usually creates better compliance than enabling every restriction on day one. It also lets you keep a simple experience for teams that do not work on regulated contracts.
Evidence to retain
Keep the submitted timecard, approval, certification, revision history and relevant policy settings together. Operational evidence such as reminder delivery, floor-check reports and security documentation helps explain how the control worked in practice.
Backups and retention are infrastructure responsibilities too. Make sure database backups are enabled, restore procedures are tested, and access to deletion or retention settings is limited.