Hey, it's Michael.

If Phase 1 was the bedrock and Phase 2 was the blueprint, Phase 3 is where the rubber meets the road. Or maybe more accurately — where the auditor meets your timesheets.

This week's issue is the one I wish someone had handed me my first month as a GovCon controller. Because here's what nobody tells you when you take the seat: the day you sign your first labor distribution report, every compliance gap in the company becomes yours. Including the ones you didn't create. Including the ones nobody told you about. Including the ones the previous controller knew were there and didn't fix.

That's Phase 3.

When most GovCon owners think about a DCAA audit, they picture an accountant in a cheap suit asking to see the books. The books! The general ledger! The journal entries!

That's not how it works.

A DCAA audit doesn't start with your books. It starts with your timesheets and your employees. Because labor is the single largest cost on most GovCon contracts, and labor charging is the easiest thing for an auditor to verify against external evidence — the employees themselves.

If a DCAA auditor walks the floor and asks three people what contract they're charging today and gets three different answers that don't match the timesheets, you have a finding before lunch.

I've seen this exact scenario play out. The auditor asked three employees: "What contract are you charging today?" Two said Contract A. The third hesitated and said, "I think Contract B? Let me check." The timesheets said Contract A for all three.

What was actually happening: the third employee had been pulled onto Contract B three days earlier when the original lead went out sick. Nobody updated the charge code. The supervisor had been "fixing it on the back end" for years — moving labor between contracts after submission, with the best intentions.

Good intentions are not a defense in a DCAA finding.

The findings out of that single floor check: inadequate labor distribution, mischarging across contracts, supervisor override without documentation, missing timekeeping policy acknowledgments, no floor check documentation on file.

The cost: voluntary disclosure, two-year heightened scrutiny status, six figures in remediation between consultants, software changes, and policy rewrites.

All of it preventable.

DCAA audits aren't random. They follow a specific pattern, and the pattern matters because it tells you where to focus your defense.

1. Accounting System Adequacy. Are your policies and procedures documented and compliant with CAS and FAR? This is the gate. Fail it and you lose your ability to win cost-type work. Pass it and the rest of the audit gets easier.

2. Timekeeping. Daily entry by employees, strict adherence to written policy. This is the single most common finding area. Bigger than rate calculations. Bigger than unallowable cost screening. Bigger than incurred cost submission errors.

3. Labor Charging. Proper direct versus indirect classification, with a clear cost allocation methodology. Mischarging is what turns a routine audit into a voluntary disclosure (the floor check story above lives here).

4. Indirect Costs. Consistency in cost pools and allocation bases. Rates that can be justified, supported, and reproduced. If you can't explain why a cost is in a particular pool, you don't have a methodology — you have a guess.

5. Internal Controls. Checks and balances that mitigate fraud and error risk. Not just policies on paper. Evidence that the policies actually operate.

Most GovCons prepare diligently for one or two of these and get blindsided by the rest. The ones I see fail most often: timekeeping and indirect costs. The ones owners usually overprepare for: the accounting system itself, because that's the one their CPA already focuses on.

The asymmetry is the problem. The audit grades all five.

Three questions to ask yourself this week. If you can answer "yes" to all three, you're operating at Phase 3. If you can't, you've found your work.

1. Could you produce your written timekeeping policy, with current employee acknowledgments dated within the last 12 months, in under five minutes?

Most GovCons can't. The policy exists somewhere. The acknowledgments were collected once at hire and never refreshed. DCAA expects annual re-acknowledgment for the policy to count as "current." If your last cycle was more than 12 months ago, that's a gap.

2. If a DCAA auditor walked the floor today and asked three random employees what contracts they were charging, would the answers match the timesheets exactly?

Run the test yourself. Pick three people. Ask the question. Compare to the timesheets. If the answers don't match, you don't have a labor charging problem in the future — you have one right now.

3. Could you produce documentation of your last quarterly floor check, including who performed it, who was sampled, and what the results were?

If the answer is "we don't do floor checks" or "we do them but don't document them," that's the gap. Floor checks aren't optional under DCAA's expectations. Undocumented floor checks count as not done.

Four things to do this month. Each one is achievable in 2-4 hours. All four together close most of the timekeeping and labor charging exposure you have today.

1. Run a self-administered floor check this week.

Pick five employees across different contracts. Ask each one: "What contract are you charging right now? What contract did you charge yesterday afternoon? When did you last update your timesheet?" Compare to the system. Document what you find — including the gaps. This becomes your baseline.

2. Refresh your timekeeping policy acknowledgments.

If your last acknowledgment cycle was more than 12 months ago, send the current policy to every employee this month with a signature request. Most HR systems can run this as a mass acknowledgment. Document completion percentage and follow up on stragglers. Annual cadence going forward.

3. Audit your labor distribution for the last 90 days.

Pull every labor distribution adjustment made by supervisors (not employees). Document the reason for each. If there's no documented reason on file, that's a gap that needs a memo-to-file before the next audit. Going forward, every supervisor override gets a contemporaneous explanation.

4. Set up a recurring quarterly floor check process.

Calendar it. Assign an owner. Build a template for documenting what was checked and what was found. Quarterly is the minimum cadence DCAA expects. Make it routine before it becomes urgent.

Here's the part nobody tells GovCon owners: timekeeping and labor compliance aren't just compliance issues. They're scaling issues.

The reason is structural. As you grow from $5M to $20M to $50M, you add employees, contracts, and complexity. The timekeeping system that was barely adequate at 20 employees breaks at 80. The labor distribution methodology that worked with five active contracts collapses with twenty.

If you scale without fixing the foundation, you scale your audit exposure proportionally. Twice the employees, twice the contracts, twice the surface area for findings. Triple the contracts, and a single floor check can compromise three contract years of cost recovery.

The GovCons that grow profitably past $20M aren't the ones with the best proposals. They're the ones with the cleanest timekeeping and labor systems — because clean labor systems mean clean indirect rates, clean indirect rates mean competitive proposals, and competitive proposals mean profitable wins.

Phase 3 is where you stop being lucky and start being audit-ready.

If you want to go deeper this week:

•         Phase 3 deep-dive: DCAA Compliance & Labor Charging — sample timekeeping policy, the 12-point self-assessment, floor check procedures, and the unallowable cost screening guide.

•         The full 9-Phase GovCon Finance OS — the complete curriculum, from bookkeeper foundations through CFO-level strategy.

•         Join the Founding Member community on Skool — weekly office hours, peer connections, case studies. Founding member pricing locked for the first 50 members.

Phase 4: Indirect rates. The single highest-leverage piece of GovCon finance work — and the structural problem I find in 8 of every 10 sub-$50M GovCon books I open. We'll cover the three-pool structure, why most GovCons collapse it into one pool by accident, and the rate review cadence that protects your wrap rate from drifting your proposals out of contention.

Until then — schedule that floor check.

—Michael Harris, Founder/CEO of 4G Consulting, LLC