The regulations, encoded as working, audited software.

Companies on government contracts can't bill everything they spend. FAR Part 31 sorts every cost into allowable (the government reimburses it) and unallowable (the company eats it — things like entertainment, lobbying, or alcohol).

Billing unallowable costs, even by accident, means paying the money back later — sometimes with penalties — when an auditor finds it.

Before a cost is billable it must pass five checks: Is the amount sensible? Does it belong to this contract, or to shared overhead? Is it booked under the right accounting rules? Is it on the government's never-billable list? And does this contract's fine print say otherwise?

Deciding this months later, from memory, is how mistakes happen. Answering all five at the moment the cost is recorded makes the answer part of the permanent record.

Before awarding certain contracts, the government checks whether a company's accounting system is designed correctly — six checks such as "do you keep each contract's costs separate from overhead?" and "do the books tie out to what you billed?" It tests the design, not whether you've ever made a mistake.

Fail it and you can't win cost-reimbursable government work at all. It's the entry ticket.

Above certain contract sizes, the government requires standardized accounting methods so companies can't shuffle costs to their advantage. "Modified" coverage means four core rules apply; "full" coverage means all of them — plus a formal filed description of how you do your accounting (the DS-1, below).

As of July 2026 the triggers are $35 million (modified) and $100 million (full) per contract — set by a 2026 law, though the detailed regulation implementing it is still a draft. Honest reporting says so.

For large negotiated contracts, the company must hand over the cost data behind its price and certify it is accurate, complete, and current. If that data turns out wrong, the government can take money back (see defective pricing, below).

The bar keeps moving: $2 million historically, $2.5 million from late 2025, and $10 million from July 2026. Which bar applies depends on the date — using the wrong one is a common, expensive error.

Government dollar limits change over time, and the rules behind them aren't equally settled: some are laws, some are finished regulations, some are still drafts, some are temporary Defense-Department workarounds ("class deviations"), and some are last year's number carried forward because this year's update was formally skipped.

Presenting a draft rule as settled law is exactly the kind of error auditors flag. Trustworthy software tells you how solid each number is, not just the number.

Once a company crosses into full CAS coverage (a $100M+ contract), it must file a DS-1: a document describing precisely how it estimates costs, spreads overhead, depreciates equipment, and so on. From then on the company is held to its own description.

Change your accounting method after filing and you may owe the government whatever the change cost it. The DS-1 turns "our practices" from folklore into a binding document.

A company may pay its executives whatever it likes — but only a capped amount per person, per year, can be charged to government contracts. The cap is set annually: $646,000 for 2024, $671,000 for 2025.

Every dollar of pay above the cap must be carved out of billings. Miss it and it's a guaranteed audit finding.

A direct cost belongs to one specific contract — an engineer's hours on Project X, parts bought for it. An indirect cost keeps the whole company running — rent, HR, the finance team — and must be shared across all contracts by a formula.

Mixing these up is the fastest way to overbill one customer and underbill another. Keeping them separate is the very first thing the SF 1408 checks.

Shared costs are distributed through three stacked rates: Fringe (benefits — health insurance, payroll taxes — as a percentage of wages), Overhead (the cost of doing the work — facilities, supervision), and G&A (the cost of running the company — executives, accounting, HR).

These rates decide what a $100 hour of labor really costs the government — often $150+ once the stack is applied. An error compounds across every invoice.

Nobody knows the true overhead rate until the year ends, so companies bill using estimates ("provisional" rates), then compute the real ("final") rates from actual costs — and settle the difference. That settling is the true-up.

Bill at 24% all year when the real rate turns out to be 22%, and you owe the government the difference on every invoice you sent.

Set a standard ("this part should take 2 lbs of material at $10/lb and 3 hours at $20/hr"), then measure the six classic gaps between plan and reality: material price and usage, labor rate and efficiency, overhead spending and volume.

Variances tell you why a job cost more — paid too much, used too much, or worked too slowly — instead of just "it cost more."

Six months after year-end, contractors file a package proving what they actually spent, what rates that implies, and that everything ties together. "ICE" is the government auditors' standard spreadsheet format — schedules labeled A through O (this engine generates ten of them).

It's how a year of estimated billing gets squared with reality — and it's the single document auditors mine hardest for findings.

Before a month can close, three views of the same money must match: the general ledger (all spending), the job-cost ledger (spending by contract), and what was actually billed. If they agree, the month locks and can never be silently edited. If not, it stays open until fixed.

Reports built on unreconciled books inherit whatever error sits upstream. Locking closed months prevents the "quiet fix" auditors distrust most.

If certified cost data turns out to have been wrong, that's defective pricing. A "sweep" is the self-audit: take every assumption in the proposal and comb the books for anything that happened before the price was agreed that contradicts it.

Government auditors run this exact exercise after award. Running it on yourself first — and keeping the log — is the defense.

An REA (request for equitable adjustment) is the cooperative route — "this change cost us more; let's adjust the price." A CDA claim is the legal route — a formal dispute with statutory deadlines and interest. Both need an executive's certification above certain dollar lines ($350K for REAs, $100K for claims).

The certification math trips people: you add the sizes of the increases and the decreases — |+$300K| + |-$80K| = $380K — never the net ($220K). Netting understates the total and skips a legally required certification.

When the government freezes work but keeps you on standby, headquarters costs keep burning with no work to absorb them. Eichleay is the only formula federal courts accept for that damage: your contract's share of overhead → per day → times the delay days.

Courts also demand strict preconditions — a government-caused delay, being kept on standby, and being unable to take replacement work. A number without those proven is worthless.

DCAA are the government's auditors: they examine your books, question costs, and write reports — but can't make binding decisions. DCMA administers contracts: its contracting officers read those reports and issue the decisions that actually bind both sides.

Knowing which one you're facing changes the play: you persuade DCAA with records; you settle with DCMA.

Because you bill on estimated rates all year (see provisional vs final, above), someone should check every month whether reality is drifting from the estimate — and write the explanation down while it's fresh.

The auditor's question is always "you were 9% under plan in November — why?" The winning answer is a note written in November.

Every write to the ledger is recorded with a cryptographic fingerprint (a SHA-256 hash) that also bakes in the previous record's fingerprint — forming a chain. Alter or delete any historical record and every fingerprint after it stops matching. There is no way to quietly rewrite history.

"Trust me" doesn't survive an audit. "Run the verify command and check the chain yourself" does.