Skip to main content

DCAM Chapter 5 §5-908 + §5-909 — Electronic Timekeeping System Requirements & Internal Controls

Regulatory reference. This page describes what DCAA requires of a timekeeping system. It is not a description of any one product, and it is not legal or audit advice. Where the primary DCAA text is not publicly downloadable this page says so and names the sources it was reconciled across — see Sources at the end.

Overview​

DCAA Contract Audit Manual (DCAM) Chapter 5 paragraphs 5-908 and 5-909 are the two paragraphs that together define what an adequate timekeeping system must look like in a GovCon contractor environment. They sit inside the broader Chapter 5 audit framework for evaluating the contractor's labor system — 5-908 covers authorization (who is allowed to charge what to which cost objective), and 5-909 covers evaluation of timekeeping (how hours are actually recorded, corrected, approved, and trailed). 5-909 is split into two subsections: 5-909.1 (Manual Timekeeping Systems) and 5-909.2 (Automated Timekeeping Systems). An "electronic timekeeping system" in DCAA's vocabulary is an automated timekeeping system under 5-909.2.

Together these two paragraphs are the gate a timekeeping system has to pass. The system must enforce: that only the employee enters their own time, that they enter it daily (not at week-end), that all hours worked are recorded (whether paid or unpaid, billable or unbillable, direct or indirect), that the employee certifies and a supervisor with direct knowledge of the work approves, that any change after submission is captured in a tamper-evident audit trail with before/after values and reason, that charge codes are gated by authorization, and that the system has the access controls (unique credentials, password rotation, badge/credential controls) needed to make the identity of the entering employee reliable.

The standard is pass/fail, not "substantially compliant." Modern DCAA practice — reinforced by repeated GAO findings and ASBCA decisions — treats timekeeping inadequacies as system-level failures that can fail the whole accounting system audit, withhold progress payments, and cascade into False Claims Act exposure when mischarging is found. A system that satisfies these rules by construction — rather than by policy memo and good intentions — is what an adequate labor system looks like.

§5-908 — Electronic Timekeeping System Requirements​

⚠ Source note on §5-908 vs. §5-909 scope. The dcaa.mil PDF of CAM Chapter 5 is not publicly downloadable, so the wording below is reconciled across the secondary sources listed at the end of this page. Across the triangulated sources, §5-908 is consistently characterized as "Labor System Authorization/Approvals" — the authorization side of the labor system (work authorizations, who can charge what) — while the timekeeping-mechanics requirements that engineers think of as "the electronic timekeeping rules" actually live in §5-909.2 (Automated Timekeeping Systems). This page treats §5-908 as the authorization controls — enforced by gating which charge codes a person may use — and §5-909.2 as the electronic-timekeeping-mechanics paragraph. If a future DCAM release moves the automated-system rules into a renumbered §5-908.x subsection, refresh accordingly.

Labor System Authorization/Approvals (general standard)​

"When evaluating the contractor's policies for labor authorizations/approvals, the auditor should consider whether the policies and organizational structure provide for adequate control over work authorizations to assure the integrity of labor recording." — DCAM §5-908, as cited by Redstone GCI (see Sources)

"The contractor should have procedures to facilitate the accumulation and recording of labor costs to cost objectives for the purpose of determining proper cost reimbursement on Government contracts." — DCAM §5-908, as cited in multiple triangulated sources

What this means in practice. Before an employee can charge time to a contract, project, task, or indirect pool, the system must have a record that says "this employee is authorized to charge this code." A work authorization is the upstream gate; the timesheet entry is the downstream recording. The two must reconcile — if an employee enters time against a code they aren't authorized for, the system must block (or flag and route) the entry. The authorization record is its own artifact: who authorized it, when, for what date range, for which employee, for which charge code, with what ceiling (if any).

Segregation between work-assignment and work-performance​

"DCAA auditors will be looking to see that ... the proper job assignments are made by different individuals than are performing the work (to the extent practical)." — Reliascent (citing DCAM 5-908 & 5-909 audit focus)

What this means in practice. The person who authorizes (the work-assignment) cannot be the person who performs (and therefore charges). For a small contractor where this is "not practical," the system must still enforce the next-best control: an independent supervisor approval of the charge.

Reliable employee identification (badge / credential controls)​

The triangulated sources consistently describe the access-control side of §5-908 / §5-909.2 as follows:

"Employee badge issuance is sufficiently controlled so that no number is duplicated and badges are not issued to unauthorized persons." — DCAM §5-909.2 as quoted by Reliascent and Cherry Jefferson & Associates

"Procedures are in place which require the employee to report lost badges promptly." — DCAM §5-909.2 as quoted by Reliascent

"Only the employee uses their labor charging instrument to access the labor system." — DCAM §5-909.2 as quoted by Reliascent and Cherry Jefferson & Associates

What this means in practice. A timesheet entry is only as reliable as the assertion of identity behind it. The "labor charging instrument" in DCAA's wording is whatever credential authenticates the employee to the system — a badge for physical clock-in systems, a username+password for web/SaaS systems, an SSO token for modern stacks. The system must (a) not allow shared credentials, (b) detect duplicate/cloned credentials, (c) immediately revoke a lost credential on report, and (d) refuse entries authenticated by a revoked credential. Delegate entry — someone other than the employee entering time on their behalf — is a hard violation except in narrowly pre-authorized exceptional cases (e.g., employee on medical leave, time recorded retroactively under documented supervisor authorization).

§5-909 — Timekeeping Internal Controls / Floor Checks​

§5-909 — General standard​

"Procedures for manual Timekeeping Systems should provide for the accurate and complete recording of labor hours, as well as appropriate controls to ensure corrections to labor records are accurate and authorized." — DCAM §5-909.1 (Reliascent verbatim quotation)

"Procedures for automated Timekeeping Systems should provide for the accurate and current recording (e.g., no less than daily) of labor hours by authorized employees, as well as appropriate controls to ensure corrections to labor charges are accurate and authorized." — DCAM §5-909.2 (Reliascent verbatim quotation)

"The principles for manual time keeping are used for auditing an automated timekeeping system." — DCAM §5-909.2 (Reliascent paraphrase of the cross-reference)

What this means in practice. The automated system must satisfy every principle that applies to the manual system, plus the additional electronic-system controls below. The 5-909.1 → 5-909.2 cross-reference is load-bearing: where 5-909.2 is silent on a topic that 5-909.1 addresses (e.g., dual signatures), the 5-909.1 rule still applies, just expressed electronically.

Contemporaneous entry — daily, not week-end batch​

"Direct labor employees record their time no less often than daily." — DCAM §5-909.1 (Reliascent verbatim quotation)

"Employees prepare their timecards in ink, as work is performed." — DCAM §5-909.1 (Reliascent verbatim quotation)

"Automated Timekeeping Systems should provide for the accurate and current recording (e.g., no less than daily) of labor hours." — DCAM §5-909.2 (Reliascent verbatim quotation)

What this means in practice. Time is entered the day the work is performed, not at the end of the week. A timesheet that shows a whole week entered with the same created_at timestamp is a deficiency on its face. The system must capture the wall-clock moment of each entry, compare it to the work-day the entry references, and flag the gap. There is no carve-out for "I was busy on the contract Friday so I'll catch up Monday" — that gap is exactly what the rule blocks.

Per-charge-code splits — actual hours, not estimates​

"Daily recording of time worked by the employee" against the appropriate cost objective. — DCAM §5-908/§5-909 audit focus (Reliascent, GovContractAssoc)

"All hours worked for all employees are recorded (including all direct and indirect work)." — DCAM §5-908/§5-909 audit focus (multiple triangulated sources)

What this means in practice. When an employee splits a day across two contracts and an indirect pool, each split is its own line with its own hour count. Estimates ("about half on Alpha, about half on Bravo") are not acceptable — the recording must reflect actual hours. The system enforces this by making the entry unit (work_date, charge_code, hours_decimal) and requiring the daily sum to reconcile to the employee's recorded work day, including uncompensated overtime if worked.

Total Time Accounting — including unpaid hours​

The contractor must record "all hours worked ... whether they are paid or not." — DCAM §5-910 (Reliascent verbatim quotation, applies under §5-909 evaluation)

"All hours worked by employees, whether directly or indirectly related to government contracts, must be recorded. This includes regular working hours, overtime, leave, holidays and any other time off." — Deltek summary of DCAM §5-909 / Total Time Accounting principle

What this means in practice. Uncompensated overtime by salaried-exempt staff is the canonical case. If a salaried exempt employee works 50 hours in a week and charges all 50 to a single direct contract, the contract is over-charged for labor costs because the effective labor rate per hour should have been distributed across 50 hours, not 40. The system must record the full 50 even when payroll only pays for 40. This is the principle behind "Total Time Accounting" and is one of the most-cited audit findings in DCAA history.

Immutability after submission — corrections via audit-logged amendment​

"Corrections are made in ink, initialed by the employee, properly authorized, and explained on the timecard." — DCAM §5-909.1 (Reliascent verbatim quotation)

"Changes are initialed, authorized, and dated by the employee and supervisor and include a description of the reason for the change. This may be done electronically. A verifiable audit trail process is in place that collects all initial entries and subsequent changes." — DCAM §5-909.2 (Reliascent verbatim quotation)

What this means in practice. Once a timesheet line is submitted, the underlying record is immutable. A "correction" is a new record (the amendment) that points at the old record, with: (a) the original value, (b) the new value, (c) a structured reason, (d) employee re-acknowledgment, (e) supervisor re-approval. In-place UPDATE of the original row is prohibited. The audit trail is verifiable — meaning a third-party auditor can reconstruct the full edit history from system records alone, without operator help.

Self-approval prohibition​

"Employees and supervisors sign the timecards/timesheets in accordance with procedures verifying the accuracy of recorded effort." — DCAM §5-909.1 (Reliascent verbatim quotation)

"Changes are initialed, authorized, and dated by the employee and supervisor." — DCAM §5-909.2 (Reliascent verbatim quotation, emphasizing the and)

DCAA Adequacy Element #1 — the employee may never be the supervisor on their own time. — DCAA Audit Program convention, reinforced by GAO-08-857 timekeeping findings

What this means in practice. Employee and supervisor are two distinct human identities. The system rejects any submission where employee_user_id == approver_user_id — both on initial submission and on every amendment. If the supervisor is unavailable (vacation, role change), the rule does not relax — the system either holds the entry until a real second human reviews, or escalates to a designated backup supervisor with their own credentials.

Supervisor approval with direct knowledge of the work​

Supervisors must verify timecard accuracy through signature (manual) or electronic authorization (automated) — and the approval must be "meaningful, not automatic." — Cherry Bekaert summary of DCAA §5-909 audit practice

What this means in practice. A "click-through approve all" UI is a finding. The supervisor must see what they are approving — the specific charge codes, the specific hours, any flagged anomalies (late entries, suspicious splits, unauthorized codes that slipped through) — and act on each. The system must capture the wall-clock duration between "supervisor opened the timesheet" and "supervisor clicked approve"; a sub-second approval on a week with anomalies is itself a flag.

Unique credentials + password rotation (typically every six months)​

"There must be password protection for logging into the system, and each employee's password must be changed every six months." — govcon365.com summary of DCAM §5-909.2 access control practice

"DCAA requires that systems demand a unique password for all users to access their timesheets, and require that the password be changed at least every six months." — Multiple triangulated sources (hubstaff, myhours, govcon365)

⚠ The verbatim DCAA wording specifying the 180-day rotation interval is not directly recoverable from the publicly-fetchable DCAM PDF (403 on dcaa.mil). The six-month rotation is consistently cited across audit-firm guidance, govcon-vendor compliance pages, and SaaS-vendor compliance certifications. Synthesis from ~5 independent sources.

What this means in practice. Each employee has a unique credential (no shared logins, no team accounts) and is forced to rotate the credential at least every 180 days. For modern SSO/IdP-based systems, the rotation is delegated to the IdP — but the timesheet system must still observe the IdP's last-rotation timestamp and refuse logins where the IdP credential is stale beyond the 180-day window.

Employee certification at submission with verbatim text capture​

"Employees must certify their timesheets" through digital sign-off, checkbox, password, or PIN. — Hubstaff summary of DCAM §5-909.2 certification practice

Personal confirmation required; no third-party submission allowed. — Multiple triangulated sources

⚠ The exact certification wording mandated by DCAA is not standardized — DCAA accepts any wording that captures (a) employee attestation of accuracy and completeness, (b) acknowledgment that the time entered is for work actually performed, (c) acknowledgment that falsification carries criminal penalty under 18 U.S.C. § 1001 and civil exposure under the False Claims Act. Verbatim DCAA wording not recoverable from public sources; synthesis from 4 independent sources cited below.

What this means in practice. At submission the employee sees a certification statement (typically referencing 18 U.S.C. § 1001) and affirmatively checks/clicks/types-PIN to attest. The system must capture the exact text the employee saw at the moment of submission — because the certification wording may evolve over the years and an auditor reviewing a 2027 timesheet in 2030 needs to see the 2027 wording, not the 2030 wording. Store the certification text inline on the submission record, not as a foreign key to a "current certification text" config row.

Audit trail with before/after values and structured reasons​

"A verifiable audit trail process is in place that collects all initial entries and subsequent changes." — DCAM §5-909.2 (Reliascent and Cherry Jefferson & Associates verbatim quotation)

"The timekeeping system must keep an audit trail for all initials and changes." — DCAM §5-909.2 (Reliascent verbatim quotation)

"Documentation of the original charge and corrected charge" with "clear explanation for changes required" and "preservation of audit trail showing who made changes and when." — Cherry Bekaert summary of DCAM §5-909 audit trail standard

What this means in practice. "Audit trail" in DCAA's vocabulary means every state transition is recorded with before-value, after-value, actor, timestamp, and reason. Reasons must be structured (a typed dropdown — "Correction of incorrect charge code," "Hours adjustment," "Late entry," "Supervisor request for split," etc.) so they can be analyzed in aggregate, not free-text alone. The trail must be queryable by a third party without operator help.

Training acknowledgments at hire and annually​

"Training at hire and annually with documented evidence retained." — Cherry Bekaert summary of DCAM §5-909 training requirement

"Provide adequate training and education to employees about timekeeping procedures and the importance of compliance." — Deltek summary of DCAM §5-909 training principle

⚠ Verbatim DCAA wording on the training cadence is not recoverable from public sources; the at-hire-and-annually pattern is cited consistently across 3+ audit-firm guidance pages. Synthesis from independent sources.

What this means in practice. Every employee has a training_acknowledgment record per-policy-version, dated, signed/clicked. On hire the employee cannot submit their first timesheet until the acknowledgment is on file. Annually thereafter the system blocks new submissions if the most-recent acknowledgment is >365 days old, until a fresh acknowledgment is captured.

Three-year retention with no-deletion​

Records retained per FAR Subpart 4.7, typically three years after final payment. — Cherry Bekaert citation of the FAR-side retention rule that complements DCAM §5-909

Contractors must retain historical timekeeping records "typically three to six years." — Deltek; Hubstaff; multiple triangulated sources

What this means in practice. Once a timesheet is submitted, the record cannot be deleted — period. Even amended entries are amended-not-replaced. Retention is at minimum three years after final payment of the contract the labor charged to; in practice keep six years to cover overlapping audits and statute-of-limitations on False Claims Act exposure.

§5-909 Internal Controls — Floor Checks (the audit-side surface of §5-909)​

The purpose of floor checks is "to verify the existence of employees and evaluate the timekeeping internal controls." — DCAA Audit Program 17740 (Major Contractor Labor Floor Checks or Interviews), summarized by Cherry Bekaert

"DCAA real-time labor evaluations include: evaluating timekeeping procedures and internal controls, employee interviews, discussing the nature of work performed, observations of the employee's workstation, analysis of employee timekeeping practices, and reconciliation of labor charges with subsequent payroll and labor distribution records." — DCAA Real-Time Labor Evaluations briefing (dcaa.mil)

DCAA auditors periodically perform physical observations of work areas and interviews of employees to determine if: "employees are actually at work," "employees are performing in their assigned job classification," "employee time is charged to the appropriate cost objective." — DCAA Audit Program (Major Contractor Labor Floor Checks), McNew Associates summary

What this means in practice. Floor checks are the audit-side of the rules above — DCAA shows up, picks employees at random, asks them where they're working today and what charge code they're on, and compares the employees' answers to what the timekeeping system shows them charged. An adequate system makes this comparison easy for the auditor: per-employee labor distribution must be queryable as of any point-in-time (not just end-of-period), and the comparison surface must show observed code vs. recorded code with timestamps.

Labor distribution reconciliation​

The contractor must "reconcile labor hours between distribution summaries and timekeeping systems." — DCAM §5-910 (Reliascent verbatim quotation, applies under §5-909 evaluation)

"Reconciliations between the distribution summary and the labor charges." — DCAM §5-908/§5-909 audit focus (Reliascent, GovContractAssoc)

What this means in practice. Hours in the timekeeping system, hours hitting payroll, and hours hitting cost-objective allocation in the GL must all reconcile to the same totals per period. Any variance is itself a finding. An adequate system makes the three-way reconciliation routine, with the residual surfaced at every period close.

Unauthorized charge codes​

"Employees blocked from charging codes they are not authorized for." — Hubstaff / Aprio / multiple triangulated sources, synthesizing DCAM §5-908 authorization + §5-909.2 audit-trail rules

⚠ Verbatim DCAA wording on this enforcement is not recoverable from public sources, but the rule is the direct consequence of §5-908's "adequate control over work authorizations" requirement combined with §5-909.2's "labor hours by authorized employees" wording. Synthesis from 4+ independent sources.

What this means in practice. The list of charge codes an employee sees when entering time is filtered to codes they're authorized to charge. The filter is enforced at the database level (foreign key to an employee_charge_authorizations table with effective-date range), not at the UI level — direct-API submissions must hit the same gate.

Late-entry flagging​

Entries made after the day of work are "flagged for supervisor review." — Synthesized from DCAM §5-909.1 ("record their time no less often than daily") + audit practice

⚠ DCAA does not explicitly prescribe a 24-hour cutoff in the public DCAM text; the flagging-and-supervisor-justification pattern is the consistent industry practice for compliance with the "daily" requirement when late entries are unavoidable. Synthesis from 5+ independent sources.

What this means in practice. Every entry where entered_at::date > work_date is flagged. The supervisor approval workflow surfaces late-entry flags prominently and requires the supervisor to enter a reason if they approve. Aggregate late-entry rates per employee per quarter are reportable to management as an early-warning metric.

Delegate entry restrictions​

"Only the employee uses their labor charging instrument to access the labor system." — DCAM §5-909.2 (Reliascent verbatim quotation)

"Employees must enter their own time" — third-party submission not allowed except in narrow pre-authorized exceptional cases. — Cherry Bekaert / Hubstaff / multiple sources

What this means in practice. The default is no delegation, ever. Exceptional cases (medical leave, employee terminated mid-period) require: (a) a pre-existing supervisor-signed delegate authorization record covering the date range, (b) a flag on the entry indicating it was delegate-entered, (c) employee retroactive acknowledgment when they return (or a documented reason why retroactive acknowledgment was not obtained).

Sources​

DCAA publishes the Contract Audit Manual, but the Chapter 5 PDF and the related audit programs are not retrievable without a manual download from dcaa.mil. The wording on this page is therefore reconciled across the audit-firm and consultancy renditions below, which quote the paragraphs verbatim and agree with one another. Where no verbatim DCAA wording could be recovered, the text above carries an explicit ⚠ flag.

How current this is​

Last checked 2026-08-04 against the sources above. DCAA typically issues Contract Audit Manual updates once or twice a year; re-check on any new Chapter 5 release, and cross-check against Common audit deficiencies to confirm the deficiency patterns still line up with the requirements as worded.

Where this shows up in Arcvue​

This page is the rule, not the product. For how time is actually entered, certified, approved and billed in Arcvue, see Timekeeping for the person entering time, Mobile for the phone app, and Timekeeping and billing for the controller view.