In January 2019, the Defense Contract Audit Agency (DCAA) issued MRD 19‑PIC‑001(R), revising its long‑standing approach to auditing incurred subcontract and inter‑organizational transfer costs. At the time, the memorandum signaled a meaningful shift away from routine, life‑of‑the‑subcontract assist audits toward a risk‑based, annual assessment model.
Since then, DCAA has continued to refine its incurred cost audit methodology, particularly as it relates to subcontract costs, risk‑based sampling and coordination between prime and subcontract auditors. These changes, coupled with broader reforms to incurred cost oversight, have materially altered how contractors should prepare for and manage subcontract cost audits today.
The Government’s Right To Audit Subcontract Costs
As a threshold matter, it remains important for both prime contractors and subcontractors to understand the government’s audit rights. Those rights are derived from statute and implemented through Federal Acquisition Regulation (FAR) 52.215‑2, Audit and Records – Negotiation.
Under this clause, the government has the right to audit the costs of any subcontract other than firm‑fixed‑price subcontracts or subcontracts for commercial products or commercial services, regardless of the type of prime contract. Conversely, even when the prime contract is cost‑reimbursement, the government does not have audit rights over subcontractors performing firm‑fixed‑price or commercial subcontracts.
This foundational rule has not changed, but DCAA’s approach to exercising that audit right has evolved significantly.
From Life‑of‑Subcontract to Risk‑based Oversight
Prior to 2019, DCAA commonly requested subcontract assist audits repeatedly over the life of a subcontract. MRD 19‑PIC‑001(R) formally ended that practice, directing auditors to reassess subcontract risk annually and request assist audits only when risk factors warranted additional scrutiny.
That risk‑based philosophy has since been embedded more broadly into DCAA’s incurred cost audit framework. Effective for submissions received beginning in 2020, DCAA implemented risk‑based sampling of incurred cost proposals, which materially reduced the volume of audits while allowing auditors to focus on higher‑risk contractors and cost areas. This approach is now codified in CAM Chapter 6, including guidance on evaluating subcontract costs within the broader incurred cost risk assessment.
Enhanced Communication Between Prime and Subcontract Auditors
DCAA continues to emphasize two‑way communication between prime and subcontract auditors as a cornerstone of subcontract cost risk assessment.
Prime contract auditors are expected to communicate with subcontract auditors regarding:
- Prior audit history and unresolved issues
- Eligibility for the low‑risk sampling pool
- Reliability of indirect rate structures and budgets
- Any known issues that may elevate subcontract risk
Subcontract auditors, in turn, are expected to inform prime auditors of significant risks identified during the year that could affect subcontract costs billed to the prime.
This coordinated approach is designed to reduce redundant audit activity and avoid situations where subcontract costs are questioned late in the prime contractor’s incurred cost audit cycle.
Low‑risk Determinations and the Role of Sampling
Communication surrounding the issuance of a low‑risk memorandum (LRM) remains critical. Under DCAA’s current policy, incurred cost submissions that meet adequacy requirements and fall below certain auditable dollar volume (ADV) thresholds may be eligible for inclusion in the low‑risk pool and exemption from audit through statistical sampling.
DCAA has publicly attributed its success in eliminating the historical incurred cost audit backlog to this risk‑based sampling methodology, which allows auditors to allocate resources to higher‑risk audits, including business system reviews and complex subcontract structures.
Prime Contractor Responsibility for Subcontract Management
The 2019 MRD also reaffirmed that prime contractors retain responsibility for managing subcontractors but clarified how that responsibility should be evaluated during incurred cost audits.
Importantly, DCAA guidance instructs auditors not to question subcontract costs solely because of deficiencies in the prime contractor’s subcontract management system. Instead, auditors should 1) design audit procedures sufficient to mitigate risk to the government, and 2) separately determine whether identified deficiencies warrant reporting.
This position aligns more closely with case law, including the Lockheed Martin Integrated Systems, Inc. decision, in which the Armed Services Board of Contract Appeals rejected a government claim based on an auditor‑driven legal theory that overstated the prime contractor’s responsibility for subcontractor accounting practices.
Broader Developments Affecting Incurred Cost Audits Since 2019
Beyond subcontract‑specific guidance, several broader developments affect how contractors should view incurred cost audits today:
- Formal risk stratification of incurred cost proposals into low, medium and high‑risk categories, based on both quantitative and qualitative factors, including prior findings and internal controls.
- Expanded use of independent public accountants (IPAs) to perform certain incurred cost audits, allowing DCAA to focus internal resources on higher‑risk and more complex audits.
- Continued emphasis on timely adequacy reviews, with DCAA targeting completion of adequacy assessments within 60 days and audits within one year of receiving an adequate submission.
Collectively, these changes reflect a more disciplined, risk‑focused audit environment that rewards contractors with strong systems, clean audit histories and effective subcontract oversight.
What Contractors Should Do Now
From an advisory perspective, contractors should consider the following proactive steps:
- Strengthen subcontract cost visibility, including invoice review procedures and documentation supporting allowability and allocability.
- Engage early with auditors, particularly if known subcontract risks exist, rather than waiting for issues to surface during fieldwork.
- Focus on adequacy and consistency, as eligibility for low‑risk sampling often hinges on clean submissions and reliable internal controls.
- Coordinate internally between contracts, finance and supply chain teams, recognizing that subcontract management is now evaluated holistically rather than transaction by transaction.
DCAA’s shift to risk‑based oversight of subcontract costs began in 2019, but its full impact is being felt today. Contractors that understand how subcontract cost risk is assessed and that align their internal processes accordingly are better positioned to minimize audit disruption, avoid questioned costs, and expedite contract closeout in an increasingly selective audit environment.
Cherry Bekaert’s team of government contracting consultants has extensive experience with incurred cost audits and understands the evolving requirements that impact your business. If you have any questions specific to your situation, our professionals are available to discuss your situation with you.
