"DCAA Approved" Timekeeping Systems

We read about them, we hear about them, we see the advertising and press releases, many we've seen in practice and we're frequently asked advice about them. We saw another new one advertised just last week. What are we talking about? We're talking about vendors who are promoting "DCAA approved timekeeping systems" or DCAA compliant timekeeping systems. There are at least a couple dozen competing products out there, probably many more. One thing they all have in common however, is that none of them have been "approved" by DCAA (Defense Contract Audit Agency). DCAA does not "approve" commercial timekeeping software/systems. (The same goes for  commercial accounting software). DCAA is a Federal Government audit organization and follows strict guidelines (i.e.Generally Accepted Government Auditing Standards) for maintaining their independence in fact as well as appearance. The Agency does not endorse products.

So what's going on here? What are all these claims touting DCAA's approval? At best, these electronic or web-based timekeeping systems have been bought, installed, and used at one or more Government contractors who, after an audit by DCAA of their timekeeping system, received an audit opinion that their timekeeping system was "adequate" (By the way, "adequate" is as good as it gets when it comes to audit opinions. There is no higher rating than that). So these vendors can claim that since no deficiencies were found during the audit, their systems must be good enough for Government work. Or perhaps vendors compared the features of their product to DCAA audit guidance (see DCAA Contract Audit Manual 5-909.2) on what to look for in an electronic timekeeping system and were able to self-assess the sufficiency of their product.

In reality, the software used to collect employee hours is only part of a timekeeping system - usually the simplest part. Most of these electronic timekeeping systems are very similar in the way they work. They are very simple databases with a user interface. The employee logs on with a user ID and password and enters his/her time for the day. Later, supervisors review and approve the employees' electronic timesheets. Then the hours are tallied according to the needs of the organization (usually by project, work order, task, etc). Most of these products include an audit trail so that one can determine who made entries and whether any changes were made and by who and for what reason.

But, as we stated, the software component is only one part of the timekeeping system. The most significant part of the system and the most difficult to implement is the policies, procedures, and practices and the internal controls. Perhaps the most difficult aspect of all is getting employees to record their hours on a timely basis (daily, according to DCAA). This requires policies, procedures, training, compliance reviews, and reporting. It probably necessitates some form of disciplinary action when employees do not comply (e.g. progressive from oral reprimand all the way to removal). It requires a genuine commitment from management who must set the "tone at the top".

We know of contractors who have implemented these so-called DCAA approved software products yet have failed audits of their timekeeping systems, not because of the software but because the implementation was not adequate or was adequate but compliance was not sufficient. Do not be misled by the claims of software publishers. Do not become complacent in thinking that your timekeeping systems is fine just because you have purchased or licensed a product that claims to be "audit proof".