DCAA does not audit
accounting software.
It audits your entire
operational control system.
Ten operational papers covering the full DCAA adequacy lifecycle — timekeeping, job costing, indirect rates, billing, ICS, FICS, procurement, and internal controls.
Most GovCon firms treat compliance as a reporting function — something assembled before each audit. DCAA treats compliance as a system function. This canon defines the operational mechanics of every compliance domain DCAA evaluates, and how a contract-native operating system satisfies each one continuously.
Ten operational papers covering the full DCAA adequacy lifecycle — timekeeping, job costing, indirect rates, billing, ICS, FICS, procurement, internal controls, and the Compliance Command Center. The regulatory mechanics Canon I and Canon II do not go into.
"Compliance is not a reporting function. It is a system function. The GovCon Compliance Canon defines the architecture that satisfies it — continuously, operationally, and by design."
Why Legacy Stack Fails GovCon
These outcomes are structural, not accidental. Fragmented systems force leaders to manage reconciliation, lag, and compliance risk instead of execution.
Timekeeping Assembled After the Fact
Labor charges reconstructed or corrected outside the contemporaneous submission window. DCAA defines timekeeping adequacy by when entries are made — not when they are correct.
Rates Calculated at Period End
Indirect rates derived at month-end from pool and base snapshots. Billing rates applied before final calculations. Variance accumulates invisibly until reconciliation forces corrections.
ICS/FICS Assembled from Disparate Systems
40–120 hours per engagement reconciling timekeeping, payroll, G/L, and billing across systems that were never designed to produce Schedules A–O automatically. DCAA sees the seams.
Unallowable Costs Discovered at Audit
FAR Part 31 allowability determinations made at review time, not at entry time. Unallowable costs accumulate in pools, distort rates, and create findings that require costly retroactive corrections.
Audit Trail Reconstructed, Not Generated
Evidence assembled in response to DCAA requests — not captured at the point of every operational event. Reconstructed trails have gaps DCAA can find. Generated trails do not.
Legacy ERPs were built to process transactions and produce reports. DCAA examines whether the system enforced compliance at the point of every transaction — before costs posted, before hours approved, before invoices submitted. Periodic compliance architecture cannot satisfy a continuous compliance standard.
Compliance as Reporting vs. Compliance as OS
A side-by-side comparison of structural assumptions and operational outcomes.
Compliance as Reporting (Legacy ERP)
Compliance as OS (xpdOffice)
Get the complete Compliance Canon package.
Receive the synthesized Canon, the full paper series, and the category-defining operating model in one delivery built for leadership review.
Secure the Complete Canon
Get the synthesized doctrine plus all 13 flagship papers in a single ZIP archive.
Explore the 13 Papers
Move through the Canon paper by paper, from the structural diagnosis to the operational blueprints and compliance frameworks.
Why This Compliance Canon Exists
Compliance knowledge is scattered across manuals, regulations, audits, and consultant advice. This canon organizes it into a coherent operational framework. It maps each DCAA evaluation area to the specific operating system behavior that satisfies it continuously.
Compliance is a system property, not a checklist. This canon defines the architecture that enforces timekeeping, rate management, billing, and controls continuously, by design.
"Compliance is not a periodic report. It is a continuous operational state. The Compliance Canon defines the systems architecture that engineers it."
Who This Canon Is For
The Operational Mechanics of Every Compliance Domain
Indirect rate engineering, job costing architecture, ICS/FICS mechanics, billing adequacy requirements, and the internal control environment DCAA evaluates — at the depth required to design and defend the system.
What DCAA Actually Examines on Every Audit
The full audit lifecycle mapped to specific operational requirements — what examiners look for in timekeeping, labor distribution, procurement files, audit trails, and segregation of duties. The compliance standard stated operationally, not bureaucratically.
The Compliance Architecture Standard for Platform Evaluation
The ten compliance domains and the specific operational behaviors required to satisfy each. A framework for evaluating any GovCon platform claim about DCAA compliance — not on marketing language but on architectural behavior.
Frequently Asked Questions
What does DCAA actually audit?
DCAA does not audit accounting software. DCAA audits operational control systems — the full lifecycle of timekeeping, labor distribution, job costing, indirect rates, billing, procurement, contract management, and internal controls. Paper 1 (The DCAA Operating Model) defines this system and the six adequacy pillars DCAA evaluates across pre-award, forward pricing, incurred cost, and final settlement audits.
What is DCAA system adequacy and how is it determined?
System adequacy means the firm's operational control systems satisfy DCAA's six adequacy pillars: timekeeping integrity, labor distribution accuracy, indirect rate calculation and application, billing accuracy, procurement controls, and internal control environment. Adequacy is determined through examination of system behaviors — not through certification. DCAA examiners test whether the system enforces compliance at the point of every operational event, not whether the firm can produce compliant reports on request.
What is the Compliance Command Center?
The Compliance Command Center is xpdOffice's real-time compliance dashboard — a unified operational view of every compliance domain simultaneously: timekeeping status, indirect rate health, CLIN ceiling utilization, billing adequacy, ICS readiness, FICS progress, and audit trail completeness. It converts compliance from a periodic preparation exercise into a daily operational function. Paper 10 (The Compliance Command Center) develops this in full.
How is Canon III different from Canon I and Canon II?
Canon I makes the operational and strategic case for contract-native architecture — written for CEO, COO, and CFO audiences. Canon II makes the computational and systems architecture case — written for CIO, CTO, and enterprise architects. Canon III defines the regulatory mechanics of every compliance domain DCAA evaluates — written for controllers, compliance officers, and program managers who face audits directly. Three canons, three audiences, three abstraction levels, one underlying architecture.
Why does ICS/FICS preparation take 40–120 hours in legacy ERP firms?
Because Schedules A–O must be assembled from systems that were never designed to produce them automatically: timekeeping data from one system, payroll from another, general ledger from a third, billing from a fourth. The reconciliation between these systems — which maintain different versions of the same facts — is what consumes the hours. xpdOffice maintains ICS/FICS readiness continuously because all of these domains share the same contract-governed data layer. There is no reconciliation because there is no inconsistency. Paper 6 (ICS) and Paper 7 (FICS) cover this in operational detail.
Does "continuous compliance" require more work from operational staff?
No — the opposite. Continuous compliance transfers the compliance enforcement burden from operational staff (who must remember and apply rules manually) to the system architecture (which enforces rules at the point of every transaction automatically). Staff spend less time on compliance corrections, less time on audit preparation, and less time reconciling between systems. The compliance overhead moves from human review cycles to architectural enforcement — and architectural enforcement is always on.
Ready to shift to a BOS Architecture?
The Canon is the beginning. The architecture is the work. Secure the complete executive doctrine today and begin the transition to contract-native operations.
"The firms that reach $100M+ are those that solve architecture before they reach it."