It was my first day as CFO of a small publicly traded AI company in Palo Alto. I hadn't even found the coffee machine when someone told me a government auditor named Martin was sitting in the conference room, waiting to speak with the CEO.
Martin was the audit manager from the Defense Contract Audit Agency, known as DCAA. The agency audits companies doing business with the Department of Defense, making sure contractors are charging the government fairly and in compliance with federal cost regulations. The company had been a government contractor for more than 20 years, primarily on DARPA research contracts, and DCAA had been a regular presence at the company for most of that time.
The problem was that the company had been without a CFO for 8 months. My predecessor had left the company well before my arrival, and no one had filled the role. During that vacuum, DCAA had launched a multi-year audit covering 4 fiscal years of incurred cost submissions. They'd found what they believed was a significant misallocation of R&D expenses to the government's indirect cost pools, and they wanted roughly $2.5 million back. With penalties and interest accumulating, and additional audit years ahead, the total exposure would eventually grow far beyond that.
I had no experience in government contract accounting. None. I'd spent my career in commercial finance, Wall Street, and management consulting. I didn't know what an incurred cost submission was. I didn't know what indirect rate pools were. I didn't know the difference between an allowable cost and an unallowable one. And the government auditor was already in the building.
Walking into the conference room
I told the CEO I'd go in and talk to Martin myself. My logic was simple: the company needed someone who could engage with DCAA credibly, and that person was going to have to be me. There was nobody else.
I sat down with Martin and did something that, in retrospect, was probably the most important decision I made in the entire multi-year process. I was honest. I told him I was new, that I had no government contracting background, and that I needed time to come up to speed on both the regulatory framework and the company's specific history with DCAA. I didn't get defensive about what the company had done. I didn't make promises I couldn't keep. I asked for 30 days.
What I promised in return was that after those 30 days, I'd be able to speak intelligently about the issues DCAA had raised, and that I'd work with them transparently going forward. Martin agreed. I think he was relieved. He'd been dealing with a company that had no financial leadership, no one who understood the audit process, and no path toward resolution. Having someone across the table who was willing to engage honestly, even if they were starting from zero, was better than what he'd been dealing with.
After Martin left, I walked into the CEO's office and told him what had happened. Gary jumped out of his chair, grabbed my hand, and said, "God bless you, Michael!"
Learning government contract accounting in 30 days
I'm a self-learner. I went to Amazon and bought every introductory government contracting book I could find, plus reference copies of the FAR (Federal Acquisition Regulation), the DFARS (Defense Federal Acquisition Regulation Supplement), and the CAS (Cost Accounting Standards), which lays out the basic principles of federal cost accounting. The FAR alone runs to thousands of pages, which is intimidating until you realize that for most government contractors, the meat of what matters sits in a handful of chapters. Chapter 31, which covers cost principles and procedures, was where I spent most of my time.
Here's a quick primer on what I had to learn, because most people outside of government contracting have never encountered these concepts.
When a company does work for the federal government, its costs fall into 2 categories. Direct costs are charged to a specific contract: the engineer who spends 40 hours on a DARPA project, or the materials purchased for that project. Indirect costs are shared expenses that benefit the company as a whole and get allocated across all contracts through a system of cost pools and rates.
Those indirect cost pools typically include fringe benefits (health insurance, payroll taxes, retirement contributions), overhead (facilities, equipment, IT infrastructure), and general & administrative expense, or G&A (executive salaries, accounting, legal, business development). Each pool gets its own rate, and those rates determine how much of the company's shared costs get billed to the government.
The critical thing about this system is that it only works if costs land in the right pools and the rates are calculated correctly. The government will pay its fair share of legitimate indirect costs, but it won't pay for costs that are unallowable under the FAR (things like alcohol, entertainment, lobbying, and certain types of interest expense), and it won't pay for costs that have been misallocated between pools.
That misallocation question was the heart of the dispute. The previous CFO had classified certain R&D development costs as indirect expenses allocable to the government. His argument was that this R&D kept the company viable and that the resulting technology could benefit future government contracts. DCAA's position was that these costs were commercial in nature and shouldn't be allocated to government work at all. Over the 2 audit years in question, those costs totaled about $2.5 million.
Getting my bearings
While I was reading FAR chapters at night, I was also getting oriented inside the company during the day. I had Jason, the controller, who'd been at the company for years. Jason didn't have deep government contract accounting expertise, but he knew the company's history and could walk me through the existing systems.
The accounting system was an old version of Great Plains that wasn't configured for government contract accounting. Costs weren't flagged or segregated in a way that mapped to the indirect cost pool structure. To build an incurred cost submission, someone had to dump the entire general ledger into Excel and classify transactions one by one. The existing Excel model for incurred cost submissions had been built by the previous CFO and modified so many times that it no longer resembled the standard DCAA template it was originally based on. Links were broken, logic was inconsistent. It was, to be blunt, a rat's nest.
But fixing the model wasn't my priority in those first 30 days. Understanding the nature of the dispute was. I needed to know enough about government contract accounting to have an intelligent conversation with Martin, and I needed to understand where the $2.5 million sat in the numbers. Everything else could wait.
I also found a government contracting newsletter published by a practitioner who turned out to be enormously helpful. I called him, explained my situation, and he became an ongoing resource as I built my knowledge. That relationship would pay off in unexpected ways down the road.
A strategic redirect
When the 30 days were up, I drafted a detailed email to Martin laying out where I was in my understanding and proposing a path forward. I used enough of the right terminology to establish that I'd done the work (cost principles, allowability, allocability, indirect rate structures) without pretending to be an expert.
Here's what I proposed: DCAA had already told the company before my arrival that they intended to audit 2 additional fiscal years beyond the 2 already in dispute. I suggested we move forward with those audits. My reasoning was layered. On the surface, I was cooperating fully with their audit plan. But it also served several other purposes.
First, it redirected their attention and resources to newer audit years, which bought me time to keep building my expertise and fix the accounting infrastructure. Second, having DCAA auditors in the building for weeks at a time gave me the opportunity to learn from them directly. I could ask questions about their process, understand what they focused on, and pick up on how DCAA thought about cost allocation issues. Third, the subsequent audit years were cleaner on the R&D allocation question because the commercial division (the source of much of the disputed R&D activity) had been sold by the company to Intuit before my arrival. That sale removed the biggest cost driver from the dispute going forward.
DCAA agreed. They had the audits on their schedule anyway, and having a cooperative CFO was a welcome change from the prior stalemate.
Rebuilding the infrastructure
While the new audits were getting underway, I tackled the accounting system. Great Plains wasn't going to work. I evaluated several options and landed on Peachtree (a Sage product) because it was affordable, could be customized for our needs, and supported enough light programming to extend its capabilities. For a company our size (maybe 3 or 4 active government contracts plus some legacy commercial consulting) I didn't need an enterprise system. I needed something I could get running fast and configure properly.
I mapped the old chart of accounts from Great Plains into Peachtree, rebuilding it with government contract accounting in mind. Every account was structured so transactions could be classified by cost type: direct versus indirect, allowable versus unallowable, and by contract. The new chart of accounts also handled the commercial work, but the architecture was built around the government contracting requirements because that's where the compliance risk lived.
The whole system selection, installation, and setup took a few months. Once it was running, I could manage most of the company's accounting with a small team: Jason as controller, plus a part-time accounts payable person instead of the full-time position we'd had before. For a company under financial stress, that efficiency mattered.
Then I built a new incurred cost model from scratch in Excel, supplemented by a SQL database for more complex queries. The old model was beyond repair, and I didn't want to inherit its errors. I tested the new model against a full year of data from the new accounting system, worked through the kinks, and about 16 months after my arrival, I submitted a complete incurred cost package to DCAA that I owned from end to end. I understood every number in it, every allocation, every rate calculation.
That was the turning point. I now had 2 years of data in a system I'd built myself, and I could speak to DCAA with genuine authority about the numbers. The subsequent year audits were completed without major issues, though they did add to the total amount the government claimed was owed.
The dispute escalates
Meanwhile, the original $2.5 million R&D allocation dispute hadn't gone away. With the subsequent audit years adding smaller findings, plus penalties and interest accumulating over time, the total government claim grew to $5.4 million across all 4 audit years.
DCAA knew we had several million dollars in cash, most of it from the sale of the company's commercial division to Intuit. They were concerned we'd burn through it before the dispute was resolved. They kept pressing for payment, though they weren't seizing assets, partly because the subsequent audits were still ongoing and partly because I was maintaining regular communication and demonstrating good faith through timely submissions and cooperative engagement.
But good faith has its limits when you're talking about $5.4 million that could shut down the company. Working with our general counsel, Ben, I concluded that the best strategy was to file a claim against the government in the U.S. Court of Federal Claims. This wasn't because I thought we'd necessarily win on the merits of the R&D allocation argument. It was because the legal process itself would buy the company years of additional runway: discovery, depositions, trial preparation, and potentially an appeal.
During this period, I also brought in an expert consultant, a retired DCAA auditor who was also a practicing attorney. He'd been referred to me by the newsletter publisher I'd connected with early in my tenure. His dual expertise (DCAA audit methodology and federal contracting law) made him invaluable both in preparing our position and in drafting the lawsuit itself.
Going to court
Filing in federal claims court initiated a formal legal process. The Justice Department assigned an attorney to represent the government's position. Discovery took time. The government deposed both me and the CEO, even though the disputed R&D allocations predated my arrival. I was the only person at the company who actually understood the government contract accounting mechanics well enough to answer detailed questions.
The depositions were manageable. I answered what was asked, didn't volunteer additional information, and stuck to what I knew. The government's attorney didn't have particularly deep expertise in government contract accounting, which worked in our favor during questioning.
The trial took place about 3 years after my arrival. I'm not going to sugarcoat this: we lost. The court ruled against the company on the R&D allocation issue. We appealed about a year later, also unsuccessfully.
Losing twice in court doesn't sound like a success story. But here's what was actually happening during those years of legal proceedings: the company was rebuilding.
The settlement
By the time the legal process concluded, the company was a different one than the one I'd walked into. The commercial revenue streams that the CEO and other executives had been building were generating enough income to support the business independently of government contracts. Government contract margins in this space run about 8% at best, and that's before accounting for unallowable costs that the company absorbs. The company couldn't survive on government work alone, and it no longer needed to.
When the court cases were resolved, DCAA had a choice. They could demand immediate full payment of the $5.4 million in disputed costs, penalties, and interest, which would have crippled or killed the company. Or they could structure a settlement.
We negotiated a deal: a total of $1.8 million, paid over 3 years. That saved the company $3.6 million off the government's full claim.
The company survived. It continued operating, paying its obligations to the government on schedule, and growing its commercial business. That outcome wasn't luck. It was the result of a deliberate strategy: buy time, build credibility with DCAA, fix the accounting infrastructure, diversify revenue, and use every available mechanism (cooperation, litigation, negotiation) to keep the company alive long enough to become viable.
What I built afterward
Years later, when I served as CFO for a venture-backed nanotech company pursuing its first DARPA contracts, I built a DCAA-compliant cost accounting system from day one. Chart of accounts structured around government contract requirements. Indirect rate pools properly defined from the start. Timekeeping systems that met DCAA standards. A clean incurred cost submission process ready to go before the first audit request arrived.
The difference between building a system right from the start and inheriting one that was broken is enormous. Everything I'd learned at the company, the hard way, under pressure, starting from zero, went into that design. The system passed its first pre-award survey without issues.
What I'd tell a founder facing their first government audit
If you're a founder or finance leader at a company that's about to encounter DCAA for the first time, a few things are worth knowing.
Your indirect rate structure is your cost model for government work. Get it wrong and you'll either overcharge the government (which creates compliance risk) or undercharge (which means you lose money on every government hour billed). Invest the time to set it up correctly before you start billing.
Your accounting system doesn't have to be expensive, but it has to be properly configured. DCAA wants to see that you can segregate costs by contract, that your timekeeping is adequate, that your indirect pools are clearly defined, and that your billing matches your disclosed accounting practices. Commercial systems like NetSuite can handle this with the right setup. You don't need specialized government contracting software if you know what you're doing.
Submit your incurred cost proposals on time. They're due 6 months after your fiscal year ends. Getting behind on these creates compounding problems: penalties, interest, and an adversarial relationship with your auditors that makes everything harder.
And if you find yourself sitting across from a DCAA auditor for the first time, be honest. Don't bluff. Don't get defensive. The auditors I worked with over 6 consecutive audits responded best to transparency, cooperation, and demonstrated competence. They're not trying to shut you down. They're trying to verify that your numbers are fair. Make their job easier and they'll make your life easier.
That lesson from my first day, when I sat down with Martin and said "I need 30 days," turned out to be the foundation for everything that followed.