Skip to main content

DCAA Internal Control Questionnaire (ICQ) — Accounting System Section

Date fetched: 2026-05-23

Substitution notice​

The dedicated DCAA Internal Control Questionnaire (ICQ) form for the accounting system is not published as a single downloadable artifact on dcaa.mil; it is incorporated into the auditor's working papers. The authoritative substitute is:

  1. DCAA Audit Program 17740 AP — Preaward Survey of Prospective Contractor Accounting System (published 2025-06-09 by DCAA): https://www.dcaa.mil/Portals/88/Documents/Guidance/Directory%20of%20Audit%20Programs/17740%20AP%20Preaward%20Survey%20of%20Prospective%20Contractor%20Accounting%20System_20250609.pdf — fetch returned HTTP 403 on 2026-05-23, URL listed as authoritative source.

  2. DCAA Contract Audit Manual (CAM) Chapter 5 — Audit of Contractor Compliance with DFARS for Contractor Business Systems and Subsystems (revised 2025-02-24): https://www.dcaa.mil/Portals/88/Documents/Guidance/CAM/CAM_Chapter_05_20250224.pdf — fetch returned HTTP 403 on 2026-05-23.

  3. DCAA CAM Chapter 6 — Incurred Cost Audit Procedures (revised 2021-03-26): https://www.dcaa.mil/Portals/88/Chapter%206%20Incurred%20Cost%20Audit%20Procedures%2003_26_2021%20(508F).pdf — fetch returned HTTP 403 on 2026-05-23.

Per the SF-1408 form itself and the DCAA published narrative on dcaa.mil ("Accounting System Requirements and Pre-Award Audits") and a corpus of audit-firm and DCAA-compliance-consultancy renditions of the working ICQ (Reliascent, Cherry Bekaert, Aprio, EverGlade, Sympaq, GRF, ICAT, VSingh CPA, Redstone GCI), the sub-questions below are the auditor's working questions per SF-1408 criterion. They have been reconciled across these sources and structured under the parent SF-1408 criterion.

Five components of internal control (per the DCAA framework) are evaluated alongside the 14 SF-1408 criteria:

  • Control Environment (tone at the top, ethics, organizational structure, HR policies)
  • Contractor's Risk Assessment (identification of FAR/CAS compliance risks)
  • Information and Communications (financial-reporting and policy-distribution flows)
  • Monitoring (internal audit, management review)
  • Accounting System Control Objectives and Activities (the 14 SF-1408 criteria themselves)

Criterion 1 — Accounting system in accord with GAAP​

Sub-questions auditors ask:

  • Is the entity on accrual basis accounting? Documented in writing?
  • Does the chart of accounts segregate revenue, expense, asset, and liability accounts at sufficient granularity to support contract cost reporting?
  • Is there a documented closing process (monthly / quarterly) with sign-off?
  • Are financial statements (income statement, balance sheet, cash-flow statement) generated on a regular cadence?
  • Are accounting policies documented for: revenue recognition, depreciation methods, inventory valuation, accruals, prepaid expenses, leases?
  • Has the contractor been audited by an external CPA? Are audit findings remediated?

Criterion 2(a) — Proper segregation of direct costs from indirect costs​

Sub-questions:

  • Does the chart of accounts have separate accounts for direct labor, direct materials, direct ODCs, direct travel, direct subcontractor costs?
  • Does the chart of accounts have separate accounts for fringe, overhead, G&A, B&P, IR&D, material handling, service centers?
  • Are the same cost types treated consistently between contracts? (Example: a program manager — direct on one project, indirect on another, is a FINDING.)
  • Are written policies in place describing when a cost is classified direct vs. indirect?
  • Is there a written CAS Disclosure Statement (for CAS-covered contractors)?

Criterion 2(b) — Identification and accumulation of direct costs by contract​

Sub-questions:

  • Is there a job/project ledger keyed by unique contract/project number?
  • Does every direct cost transaction carry a job/project number?
  • Does the job cost ledger reconcile monthly to the general ledger?
  • Are project numbers assigned at contract award (not retroactively)?
  • Are direct costs ever recorded against a "default" or "miscellaneous" project? (This is a finding.)
  • Are subcontractor invoices allocated to the correct project, and tied to the correct PO/purchase commitment?

Criterion 2(c) — Logical and consistent method for allocation of indirect costs​

Sub-questions:

  • Are the indirect cost pools defined in writing? When were they last reviewed?
  • What is each pool's allocation base? (Direct labor, total cost input, value-added, single-element, etc.)
  • Is the allocation methodology consistent across contracts?
  • Is the allocation methodology consistent across fiscal years? Have rates moved without documented cause?
  • For CAS-covered contractors: does the practice match the CAS Disclosure Statement (CASB DS-1)?
  • Are intermediate cost objectives (service centers) closed to final cost objectives via the correct base?
  • Is the contractor performing IR&D as B&P, or B&P as IR&D? (Misclassification is a finding.)

Criterion 2(d) — Accumulation of costs under general ledger control​

Sub-questions:

  • Are all costs that flow to the job cost ledger / project ledger first recorded in the general ledger?
  • Are subsidiary ledgers (AP, AR, payroll, fixed assets, inventory) reconciled monthly to GL control accounts?
  • Are the indirect rate calculations driven from GL balances, or from off-system spreadsheets? (Off-system is a finding.)
  • Are journal entries pre-approved by someone other than the preparer?
  • Is there an audit trail for every journal entry — who created it, who approved it, what supporting documentation?
  • Are top-side / consolidating entries documented and reviewed?

Criterion 2(e) — Timekeeping system that identifies labor by intermediate or final cost objective​

Sub-questions:

  • Do ALL employees (including owners, executives, administrative staff) record time?
  • Do employees enter time DAILY? (Weekly/bulk entry is now a finding per 2025 DCAA enforcement — see dcaa_common_deficiencies.md.)
  • Is every employee's full time accounted for, including uncompensated overtime (>40 hrs)?
  • Does the system require supervisor approval before time becomes part of payroll/cost allocation?
  • Does the system maintain a full audit trail of every time entry change — original value, new value, who changed it, when, why, employee acknowledgment?
  • Can a supervisor change an employee's time WITHOUT the employee's acknowledgment? (If yes, this is a finding.)
  • Are charge codes restricted by employee role (so a developer can't charge to a project they aren't assigned to)?
  • Is there an annual employee training requirement on timekeeping rules?
  • Are floor checks (unannounced timekeeping verification visits) documented and conducted?

Criterion 2(f) — Labor distribution system that charges direct and indirect labor to appropriate cost objectives​

Sub-questions:

  • Does the labor distribution flow from the timekeeping system without re-entry?
  • Does the labor distribution reconcile to: timekeeping (hours), payroll register (gross pay), job cost ledger (direct dollars), general ledger (totals)?
  • Is uncompensated overtime allocated using a defensible method (salary cap, average rate, effective rate)?
  • Are labor distribution adjustments / reclasses documented with reason codes?
  • Does any portion of labor distribution flow through a journal entry rather than the time-collection system? (If yes, that journal entry needs auditor scrutiny.)

Criterion 2(g) — Interim (at least monthly) determination of costs charged to a contract​

Sub-questions:

  • Is the job cost ledger updated at least monthly, with all direct costs and applied indirect burden at provisional rates?
  • Are provisional indirect rates documented and approved (typically by the cognizant ACO)?
  • Are monthly project status reports produced and distributed to project managers?
  • Is there a documented process for catching mis-postings and correcting them in the next month, not at year-end?
  • How long after month-end is the close completed? (≤10 business days is typical for "monthly" to be operationally meaningful.)

Criterion 2(h) — Exclusion from costs charged to government contracts of amounts not allowable per FAR 31​

Sub-questions:

  • Does the chart of accounts contain specific unallowable cost accounts (or flags) for each category of unallowable cost?
  • Is FAR Part 31.205 reviewed at least annually against the chart of accounts?
  • Are unallowable costs identified at the transaction level (e.g., a specific meal coded unallowable), or via blanket percentages? (Percentage methods are a finding.)
  • Are directly associated costs of unallowable items also tagged unallowable? (Example: travel to attend a lobbying event — both the lobbying and the travel are unallowable per FAR 31.201-6.)
  • Are unallowable costs excluded from indirect pools BEFORE allocation, not netted out after?
  • Are owner / executive compensation unallowables (over the SES cap) computed and excluded?
  • Is the allocation base "purified" of unallowable costs where required by CAS?
  • Are unallowable costs identified at the procurement / requisition stage (preventive) or only at month-end (detective)?

Criterion 2(i) — Identification of costs by contract line item and by units​

Sub-questions:

  • Is the cost-tracking system capable of breaking costs down to CLIN / SLIN / ACRN / task-order level?
  • For contracts requiring CLIN-level reporting, is direct cost charged at the CLIN level?
  • For contracts requiring CLIN-level reporting, are indirect costs allocated at the CLIN level?
  • Are units of output tracked where required (e.g., per-deliverable accounting)?

Criterion 2(j) — Segregation of preproduction costs from production costs​

Sub-questions:

  • Are preproduction / startup / mobilization costs segregated in separate accounts?
  • Is the preproduction-cost authorization documented in the contract or via written advance agreement?
  • Are preproduction costs amortized or directly charged per a documented policy?

Criterion 3(a) — Limitation of cost / limitation on payments​

Sub-questions:

  • Does the contractor track funding ceiling by contract, by funding obligation, by ACRN?
  • Are cumulative cost-to-date reports produced for cost-reimbursement contracts?
  • Does the system trigger a notification when costs reach the FAR 52.232-20 limitation-of-cost notification threshold (typically 75% or 85%)?
  • Are limitation-of-cost notices documented and sent to the contracting officer?

Criterion 3(b) — Progress payment support​

Sub-questions:

  • For fixed-price progress-payment contracts: does the system support per-FAR 52.232-16 cost-based progress billing?
  • Are progress payment requests reconciled to actual costs incurred and to the GL?
  • Are liquidation calculations documented?
  • Is total costs incurred to date verifiable and traceable to source documents?
  • For small business contractors, is the 85% progress payment rate appropriately applied?

Criterion 4 — Records support follow-on acquisition pricing​

Sub-questions:

  • Are historical actuals retained at the CLIN / task / labor-category / cost-element level?
  • Is data retention at least the FAR 4.703 minimum (3 years after final payment, or longer per contract clause)?
  • Are historical indirect rates retained alongside historical direct costs?
  • Can the contractor produce a "history" report for a specific deliverable type going back multiple years?

Criterion 5 — System currently in full operation​

Sub-questions:

  • Have the prior 14 criteria been demonstrated using LIVE data and SYSTEM-GENERATED reports?
  • If the contractor has not yet performed work on a government contract, has the contractor demonstrated capability via sample/test data?
  • Are any system components in "setup but not operational" status documented?
  • Is a corrective action plan in place for any nonexistent component?

Internal control questions — broader (Control Environment, Risk Assessment, Information & Communications, Monitoring)​

These cross-cut all 14 criteria:

Control Environment:

  • Is there a written code of conduct? Is it acknowledged annually by all employees?
  • Is there a published policy on segregation of duties (e.g., the person who approves an invoice cannot also issue payment)?
  • Is there a documented organization chart with finance/accounting reporting lines?
  • Is there an audit committee or equivalent governance body?
  • Are background checks performed on financial-system users with elevated privileges?

Risk Assessment:

  • Does the contractor maintain a documented FAR/CAS compliance risk register?
  • Are risks updated when new contract types are added (e.g., first cost-reimbursement, first FFP-LOE, first IDIQ)?
  • Are mandatory disclosure rule (FAR 52.203-13) procedures documented?

Information and Communications:

  • Are accounting policies published and available to all employees?
  • Are project managers given monthly cost reports?
  • Are billing personnel given access to current provisional indirect rates?
  • Is there a mechanism for employees to report timekeeping or billing irregularities (hotline)?

Monitoring:

  • Is there an internal audit function (or rotation-based management review)?
  • Are findings tracked, assigned an owner, and remediated?
  • Are floor checks of timekeeping performed quarterly or more frequently?
  • Are indirect rate variances analyzed at month-end? Threshold for investigation documented?

Sources​