The compliance backbone: FAR, procurement law, and what auditors actually check

Picture a $2 million federal IT services contract. A DCAA or Inspector General auditor testing compliance will typically request documents in this order:

1. The contract itself and its clauses. Auditors check which FAR clauses are incorporated by reference. A cost-reimbursement contract carries different obligations than a fixed-price one. FAR Part 16 defines these contract types, and the type determines which cost rules apply.

2. Timesheets and labor distribution records. Labor is usually the largest cost category on services contracts, and it is the single most common source of audit findings. Auditors check whether employees charged time to the correct contract, whether timesheets were signed contemporaneously (not reconstructed weeks later), and whether the rate charged matches the employee's approved labor category.

3. The cost accounting system documentation. Contractors above certain size thresholds must comply with CAS (Cost Accounting Standards), a set of 19 standards governing how costs are measured, allocated, and assigned to contracts. Auditors want to see the contractor's disclosed accounting practices and confirm the contractor actually followed them, consistency is the core CAS requirement.

4. Indirect cost rate calculations. Overhead and general and administrative (G&A) costs get pooled and allocated across contracts using a rate (for example, overhead as a percentage of direct labor). Auditors recalculate this rate independently and compare it to what was billed.

5. Subcontractor flow-down documentation. If the prime contractor used subcontractors, FAR clauses on flow-downs (obligations that must be passed to subcontractors, like equal opportunity or cybersecurity requirements) must appear in the subcontract itself, not just be assumed.

6. Certifications. Two matter enormously. The Certificate of Current Cost or Pricing Data (required on many negotiated contracts above a threshold, roughly $2 million as of recent FAR thresholds, an estimate subject to periodic inflation adjustment) certifies that the contractor disclosed all relevant cost data at the time of price negotiation. A false certification here is a direct False Claims Act exposure. The second is the small business subcontracting plan certification, relevant on large contracts with small business participation goals.

Miss any one of these, and the auditor does not just note it, they extrapolate. If timesheets for one month are unsupported, DCAA can statistically project that error across the entire year of billings, turning a small discrepancy into a six or seven figure repayment demand.

Why procurement law exists beyond the FAR

The FAR governs how the government buys. A separate but related body of law governs who is allowed to sell to it and how disputes get resolved.

The Competition in Contracting Act (CICA) of 1984 requires full and open competition for most federal procurements, which is why you see contracts posted on SAM.gov, the government's central contract opportunity and registration portal. A contracting officer who steers a contract to a favored vendor without proper justification violates CICA, and losing bidders can file a formal protest with the Government Accountability Office (GAO), the legislative branch's audit and investigative arm.

The Truthful Cost or Pricing Data Act (formerly known as the Truth in Negotiations Act, or TINA) is the legal backbone behind that certification requirement mentioned above. It exists because the government, unlike a normal customer, often cannot get competitive bids for specialized defense or technical work, so it forces contractors to disclose their actual cost data instead.

The Anti-Deficiency Act prevents federal agencies from spending or committing money Congress has not appropriated. It sounds like an internal government matter, but it affects contractors directly: work performed outside the funded scope of a contract, or continued after funding expires, may not get paid.

Who checks compliance, and how

Several bodies overlap here, and knowing which does what matters:

• DCAA audits contract costs, primarily on cost-reimbursement and time-and-materials contracts, and issues audit opinions that contracting officers rely on to settle final billing rates.
• Defense Contract Management Agency (DCMA) administers contracts day to day, monitoring performance and delivery, distinct from DCAA's cost focus.
• Agency Inspectors General (IG) investigate fraud, waste, and abuse across all federal agencies, often triggered by whistleblower complaints filed under the False Claims Act's qui tamtamTotal Addressable Market: the total revenue opportunity if you captured 100% of potential customers in your target market.View full definition → provisions, which let private citizens sue on the government's behalf and share in any recovery.
• GAO resolves bid protests and conducts broader program audits for Congress.

For context outside the US: the European Union runs a parallel but distinct regime under its Public Procurement Directives (notably Directive 2014/24/EU), enforced at the member-state level, with thresholds for mandatory EU-wide tendering published periodically by the European Commission (figures are estimates and adjusted every two years, check ec.europa.eu for current values). The underlying logic is similar: competition, transparency, and documented cost or price reasonableness, but the institutions and case law differ sharply from the US system, so professionals should not assume FAR concepts transfer directly to EU tenders.

🎬 [VIDEO: "How Government Contracting Works" - youtube.com - search this title on YouTube for a plain-language walkthrough of the federal procurement lifecycle from solicitation to award]

Where compliance actually breaks down in practice

Three failure points recur across real DCAA findings and GAO protest decisions:

Mischarged labor. Employees under deadline pressure charge hours to whichever contract has budget left, not the one they actually worked on. This is the single most cited cause of False Claims Act settlements against contractors.

Stale or inflated cost data at proposal time. A contractor negotiates a price based on a subcontractor quote, then gets a lower quote later but never discloses it before contract signing. That is a defective pricing claim under the Truthful Cost or Pricing Data Act, and it is recoverable by the government even years later.

Undocumented sole-source justifications. Contracting officers sometimes skip competition citing "unusual and compelling urgency" or "only one responsible source" (both legitimate FAR Part 6 exceptions to CICA) without adequately documenting why. GAO protests frequently succeed on exactly this gap.

Key Takeaways

• The FAR is the binding rulebook for US federal procurement, jointly issued by DoD, GSA, and NASA, with agency supplements like DFARS adding further requirements.
• Auditors reconstruct cost claims backward from timesheets and indirect rate calculations, so the absence of contemporaneous documentation, not the size of the dollar amount, is usually what triggers a finding.
• CICA mandates competition, the Truthful Cost or Pricing Data Act mandates disclosure of cost data, and the False Claims Act punishes knowing misrepresentation, three distinct legal levers that combine to police the same contract.
• DCAA, DCMA, agency Inspectors General, and GAO play distinct, non-overlapping compliance roles: know which one you are dealing with before responding to a request.
• EU procurement operates on a parallel logic of competition and transparency but under entirely different directives and institutions; do not import FAR assumptions into European tenders.