What happens after a DCAA accounting-system audit report?

DCAA may report noncompliance with the accounting-system criteria, using the terminology applicable to the contract, including material weaknesses where that term applies and system deficiencies. The contracting officer reviews the report and, if appropriate, sends a written initial determination describing each reported weakness. The contractor has 30 days to respond and must state its rationale in writing if it disagrees. The contracting officer then issues a written final determination addressing remaining weaknesses, the adequacy of proposed or completed corrective action, and system disapproval if a material weakness remains under the applicable clause. After a final determination with material weaknesses, the contractor has 45 days to correct them or submit an acceptable corrective action plan showing milestones and actions. The contractor should notify the contracting officer about the correction; the contracting officer may then task DCAA with follow-up audit work. The contracting officer makes the formal determination and administers any withholding.

What accounting-system risk areas should a contractor review?

No authoritative DCAA prevalence dataset supports ranking five categories as the most common findings. DCAA's currently published 11070 accounting-system audit program is scoped to DFARS 252.242-7006 and its 18 criteria. For contracts incorporating 252.242-7999 under the March 2026 deviation, review the criteria in that applicable clause and the contract requirements; do not infer from the repeated 18 criteria that 11070 is a published 7999 program. Segregation of duties, access, audit trails, timekeeping and labor distribution, and cost allocation are useful readiness workstreams. They are selected practical risk areas, not a DCAA ranking.

How do you fix a segregation-of-duties finding?

Map who can initiate, approve, and post each transaction type, then identify conflicts and the risks they create. Role redesign and independent review can address those risks. Where duties cannot be fully separated, document a proportionate review or other compensating control. A periodic access review can confirm that the design still works as people change jobs. DFARS and DCAA guidance do not prescribe a universal initiator, approver, and poster arrangement or a second-person approval for every transaction.

What does an adequate corrective action plan look like?

The applicable business-systems and accounting-system clauses (252.242-7005(e)(1) and 252.242-7006(e) for legacy covered contracts, or the corresponding provisions in 252.242-7998 and 252.242-7999 under the March 2026 deviation) require an acceptable corrective action plan to show milestones and actions to eliminate the material weaknesses and give the contractor 45 days after receipt of the final determination to correct the weaknesses or submit that plan. In practice, identify each weakness, its root cause, the corrective action, the owner, milestone dates, dependencies, testing, and evidence. The contracting officer evaluates the adequacy of proposed or completed corrective action. A general promise without milestones and actions does not meet the clause's description of a corrective action plan.

Can NetSuite or another ERP fix a DCAA deficiency by itself?

No single platform fixes a deficiency on its own. A capable ERP system, including NetSuite with roles and permissions, workflow approval, and audit-trail features, gives a contractor tools to build the required control. Adequacy comes from how those tools are configured and operated, not from the software license. Two contractors on the same platform can reach different outcomes depending on role design, approval routing, and whether the audit trail is enforced. The contractor implements the correction and evidence. The contracting officer determines whether the system meets the applicable criteria.

How does Lightbridge ERP help after an accounting-system material weakness?

Lightbridge ERP works as an independent readiness advisor. It helps a contractor understand the DCAA audit report and contracting officer's determination, map the cited DFARS criteria, identify root causes, configure controls, and prepare the written response, corrective action plan, and supporting evidence. The contractor submits those materials to the contracting officer. Lightbridge does not issue a government finding, certify or approve a system, make the formal determination, administer withholding, represent contractors before DCAA, or conduct the official follow-up audit.

SK Written by Sarika Krishnan with Robert LabardeeSenior Program Manager and Founder and CEO

Last updated August 2026.

Accounting system material weaknesses: what to fix after a DCAA audit report

Lightbridge ERP explains what follows a DCAA accounting-system audit report. For a covered contract incorporating the January 2025 DFARS clause or a successor clause used under the March 16, 2026 DoD class deviation, a material weakness is a deficiency, or combination of deficiencies, in internal control over information that creates a reasonable possibility of a material misstatement not being prevented, detected, or corrected on time. The contracting officer makes the formal determination. Lightbridge is an independent readiness advisor.

What DCAA-compliant means Talk to an ERP advisor

A material weakness is a defined contract term, not a general complaint about a system.

For covered contracts incorporating the January 17, 2025 versions of these clauses, DFARS 252.242-7005 and 252.242-7006 define a material weakness as a deficiency, or combination of deficiencies, in internal control over information such that there is a reasonable possibility of a material misstatement not being prevented, or detected and corrected, on a timely basis. Effective March 16, 2026, DoD Class Deviation 2026-O0050 provides 252.242-7998 and 252.242-7999 for contracts incorporating the deviation clauses; older legacy contracts may still contain 7005 and 7006 and retain the prior terminology. The possibility exists when the event is probable, or more than remote but less than likely. DCAA's May 2025 terminology memorandum and August 2025 audit alert address the January 2025 rule and explain that material-weakness terminology applies when the applicable covered contract incorporates that version. Those memoranda predate the March 2026 deviation and do not address its successor clauses. For contracts incorporating the successor deviation clauses, use the terminology in those clauses; for legacy contracts that do not incorporate the January 2025 version, auditors may retain the prior significant-deficiency terminology. DCAA uses system deficiency for a deficiency that does not rise to the level of a material weakness.

The distinction matters for how a contractor responds. A material weakness finding calls for a targeted correction to the cited control, documented in the response or corrective action plan required by the applicable clauses, followed by evidence for government review. The contracting officer makes the formal determination after evaluating the audit report and contractor response. It is not a request to rebuild the whole accounting system from scratch, and it is not a determination that the contractor acted in bad faith. For what an adequate system looks like before a finding ever happens, see the guide to DCAA-compliant accounting.

Five accounting-system risk areas deserve a focused readiness review.

DCAA's currently published 11070 accounting-system audit program is scoped to DFARS 252.242-7006 and addresses its 18 criteria. For contracts incorporating 252.242-7999 under Class Deviation 2026-O0050, the applicable clause provides the criteria; the fact that 7999 repeats the 18 criteria does not establish that 11070 is a 7999 program. The applicable DFARS/FAR clauses and other contract requirements provide the criteria; DCAA conducts the audit and publishes procedures, while the contracting officer determines system acceptability. Its procedures are tailored to the contractor's size, complexity, processes, controls, and risk. The cost-allocation card also reflects the grouping and allocation principles in FAR 31.203. The five cards below are selected practical readiness workstreams, not an authoritative prevalence ranking.

Segregation-of-duties gaps

The applicable accounting-system clause's criterion (c)(1) calls for a sound internal control environment, accounting framework, and organizational structure. Separating transaction initiation, approval, and posting can be an appropriate control pattern. The design should fit the contractor's size, complexity, processes, and compensating controls. DFARS does not prescribe one universal three-way split.

Uncontrolled or excessive system access

Review role-based access against job need, recurring access appropriateness, and segregation of duties. Remove stale access and document exceptions. Least privilege and a current access report are useful control patterns, not fixed DFARS deliverables or universal DCAA requirements. DCAA tailors procedures to the contractor's size, complexity, processes, and risk.

Missing or broken audit trail

A transaction changes with no record of the change, or an adjustment overwrites the original entry instead of preserving the evidence. The applicable accounting-system clause's criterion (c)(7) requires approval and documentation of adjusting entries. DCAA walkthroughs also consider control overrides and whether a documentation trail is maintained. Traceable source records remain essential.

Timekeeping integrity gaps

The applicable accounting-system clause's criterion (c)(9) requires the timekeeping system to identify employees' labor by intermediate or final cost objective. Criterion (c)(10) addresses charging direct and indirect labor to the appropriate cost objectives. Timely entry and documented corrections can support those controls. Labor's share of a contract varies by contract and industry, so it is not automatically the largest cost element.

Cost allocation methodology gaps

The applicable accounting-system clause's criterion (c)(4) requires a logical and consistent method for accumulating and allocating indirect costs to intermediate and final cost objectives. FAR 31.203 permits logical cost groupings, common allocation bases within each grouping, separate groupings where appropriate, and revisions when relevant circumstances change. Consistency applies to costs incurred for the same purpose in like circumstances, not one method across every contract.

Remediation combines a formal DFARS response path with targeted control work.

The applicable accounting-system clause (DFARS 252.242-7006 for legacy covered contracts or 252.242-7999 for contracts incorporating the deviation clauses under Class Deviation 2026-O0050) gives the contractor 30 days to respond to the contracting officer's written initial determination. After a final determination with material weaknesses, the contractor has 45 days after receipt to correct them or submit an acceptable corrective action plan showing milestones and actions to eliminate them. DCAA's published follow-up accounting-system audit program describes follow-up work on revised practices related to previously reported weaknesses and deficiencies. For a contract incorporating 252.242-7999, do not infer from that 7006-scoped publication that it establishes the scope of follow-up work. The cards below are an advisory workstream. The exact response and control work depend on the finding, the contract, and the contracting officer's communications.

Step 1

Read the determination and audit report

Read the contracting officer's written initial determination and any DCAA audit report line by line. Identify each material weakness, applicable DFARS criterion, affected process, and point of disagreement. The contractor must respond within 30 days of the initial determination and must state its rationale in writing if it disagrees. An auditor's report is not the contracting officer's final determination.

Step 2

Design and implement the corrective action

Use the cited criterion and evidence to design the corrective action. Reconfigure roles, workflow, interfaces, timekeeping, labor distribution, or allocation logic as needed. The right control depends on the contractor's size, complexity, process, risk, and compensating controls. Test operation and preserve evidence before notifying the contracting officer.

Step 3

Prepare the response or corrective action plan

After an initial determination, prepare the 30-day written response. If the contracting officer issues a final determination with material weaknesses, the contractor has 45 days after receipt to correct them or submit an acceptable corrective action plan showing milestones and actions to eliminate them. The plan is a response document, not a government closure.

Step 4

Submit evidence through the contracting officer

When the contractor believes the weaknesses are corrected, notify the contracting officer in writing. The contracting officer may then task DCAA to perform a tailored follow-up audit of the revised practices, but the contracting officer evaluates the evidence and makes the determination under the applicable clauses. An implementation date, accepted plan, or follow-up audit alone does not automatically close a material weakness.

Labor distribution, indirect cost pools, and system access all trace back to the same underlying discipline discussed in government contract project accounting and indirect cost rates: a control supported by appropriate methods, procedures, and controls: sometimes software-enforced, sometimes supported by documented manual or compensating controls appropriate to the contractor's circumstances, not a control that exists only in a policy document.

A material weakness can carry payment consequences under the applicable DFARS clauses.

Under the applicable business-systems clause (DFARS 252.242-7005(a) for legacy covered contracts or 252.242-7998 under Class Deviation 2026-O0050), the business-systems clause applies only to covered contracts subject to the Cost Accounting Standards. For an accounting system, the applicable clause (252.242-7006(f) for legacy contracts or 252.242-7999 for contracts using the deviation) ties withholding to a contracting officer's final determination to disapprove the system under the applicable business-systems clause. DCAA may audit and report. The contracting officer issues the determination and withholding notice.

The clause specifies an initial 5% withholding from amounts due under progress payments and performance-based payments, with a written direction to withhold 5% from billings on interim cost vouchers for cost-reimbursement, labor-hour, and time-and-materials contracts. If the contractor submits an acceptable corrective action plan and the contracting officer determines it is being effectively implemented, directly related withholding can reduce to 2%. The aggregate limits are 5% for one or more material weaknesses in a single business system and 10% for material weaknesses in multiple business systems. Payment types, exceptions, and pre-existing withholds also matter.

Withholding does not automatically end when a contractor implements a correction or completes a follow-up audit. The contractor notifies the contracting officer in writing when it believes the weaknesses are corrected. The contracting officer then determines whether to discontinue, continue, or increase withholding under the clause. If no determination is made within 90 days of that notice, the clause requires a reduction of the related withholding by at least 50%, without automatically authorizing billing for amounts previously withheld.

Lightbridge ERP works on remediation, not on the audit itself.

When a DCAA audit report or contracting officer's initial determination names a control gap, Lightbridge ERP helps a contractor understand the cited DFARS criteria, identify root causes, redesign the affected control inside the accounting or ERP system, and prepare the written response, corrective action plan, and supporting evidence. The work may include role and permission design, workflow approval routing, audit-trail configuration, timekeeping and labor distribution controls, or an indirect cost allocation methodology that fits the contractor's circumstances.

Lightbridge ERP is an independent, vendor-neutral readiness advisor. It does not define DFARS terms, issue a government finding, certify or approve an accounting system, make the contracting officer's determination, administer withholding, represent contractors before DCAA, or conduct the official follow-up audit. The contractor submits its response and correction notice to the contracting officer. For the platform and process foundation a deficiency can trace back to, see government contract project accounting and the ERP advisory engagement model.

This guide is general information, not legal, audit, or accounting advice. DFARS clauses, thresholds, and agency practice change. Verify any specifics against official sources such as acquisition.gov, the DCAA, and the DCMA, and consult qualified advisors before acting on a deficiency finding.

Accounting system material weaknesses: frequently asked questions

What is a DCAA material weakness?: For an applicable covered contract, the DFARS business-systems and accounting-system clauses are 252.242-7005 and 252.242-7006 on legacy contracts, or the corresponding 252.242-7998 and 252.242-7999 for contracts incorporating the deviation clauses under DoD Class Deviation 2026-O0050, effective March 16, 2026. Where the applicable contract incorporates the January 17, 2025 rule or the successor deviation clauses, a material weakness is a deficiency or combination of deficiencies in internal control over information such that there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis. That possibility exists when the event is probable, or more than remote but less than likely. DCAA's May 2025 terminology memorandum and August 2025 audit alert address the January 2025 rule and explain that material-weakness terminology applies when the applicable covered contract incorporates that version. Those memoranda predate the March 2026 deviation and do not address its successor clauses. For contracts incorporating the successor deviation clauses, use the terminology in those clauses; for legacy contracts that do not incorporate the January 2025 version, auditors may retain the prior significant-deficiency terminology. DCAA also uses system deficiency for a deficiency that does not rise to the level of a material weakness. DCAA conducts the audit and publishes procedures, while the contracting officer, not DCAA, makes the formal determination and decides system acceptability under the applicable contract requirements.
What happens after a DCAA accounting-system audit report?: DCAA may report noncompliance with the accounting-system criteria, using the terminology applicable to the contract, including material weaknesses where that term applies and system deficiencies. The contracting officer reviews the report and, if appropriate, sends a written initial determination describing each reported weakness. The contractor has 30 days to respond and must state its rationale in writing if it disagrees. The contracting officer then issues a written final determination addressing remaining weaknesses, the adequacy of proposed or completed corrective action, and system disapproval if a material weakness remains under the applicable clause. After a final determination with material weaknesses, the contractor has 45 days to correct them or submit an acceptable corrective action plan showing milestones and actions. The contractor should notify the contracting officer about the correction; the contracting officer may then task DCAA with follow-up audit work. The contracting officer makes the formal determination and administers any withholding.
What accounting-system risk areas should a contractor review?: No authoritative DCAA prevalence dataset supports ranking five categories as the most common findings. DCAA's currently published 11070 accounting-system audit program is scoped to DFARS 252.242-7006 and its 18 criteria. For contracts incorporating 252.242-7999 under the March 2026 deviation, review the criteria in that applicable clause and the contract requirements; do not infer from the repeated 18 criteria that 11070 is a published 7999 program. Segregation of duties, access, audit trails, timekeeping and labor distribution, and cost allocation are useful readiness workstreams. They are selected practical risk areas, not a DCAA ranking.
How do you fix a segregation-of-duties finding?: Map who can initiate, approve, and post each transaction type, then identify conflicts and the risks they create. Role redesign and independent review can address those risks. Where duties cannot be fully separated, document a proportionate review or other compensating control. A periodic access review can confirm that the design still works as people change jobs. DFARS and DCAA guidance do not prescribe a universal initiator, approver, and poster arrangement or a second-person approval for every transaction.
What does an adequate corrective action plan look like?: The applicable business-systems and accounting-system clauses (252.242-7005(e)(1) and 252.242-7006(e) for legacy covered contracts, or the corresponding provisions in 252.242-7998 and 252.242-7999 under the March 2026 deviation) require an acceptable corrective action plan to show milestones and actions to eliminate the material weaknesses and give the contractor 45 days after receipt of the final determination to correct the weaknesses or submit that plan. In practice, identify each weakness, its root cause, the corrective action, the owner, milestone dates, dependencies, testing, and evidence. The contracting officer evaluates the adequacy of proposed or completed corrective action. A general promise without milestones and actions does not meet the clause's description of a corrective action plan.
How long does it take to remediate a DCAA-cited deficiency?: The DFARS response clocks are defined, but technical remediation duration is not. The contractor has 30 days to respond to the contracting officer's written initial determination. After a final determination with material weaknesses, the contractor has 45 days after receipt to correct them or submit an acceptable corrective action plan showing milestones and actions. The time to design, configure, test, and evidence a control varies with scope, size, complexity, dependencies, and risk. An implementation date or plan does not itself close a weakness; the contracting officer makes the applicable determination.
Can NetSuite or another ERP fix a DCAA deficiency by itself?: No single platform fixes a deficiency on its own. A capable ERP system, including NetSuite with roles and permissions, workflow approval, and audit-trail features, gives a contractor tools to build the required control. Adequacy comes from how those tools are configured and operated, not from the software license. Two contractors on the same platform can reach different outcomes depending on role design, approval routing, and whether the audit trail is enforced. The contractor implements the correction and evidence. The contracting officer determines whether the system meets the applicable criteria.
How does Lightbridge ERP help after an accounting-system material weakness?: Lightbridge ERP works as an independent readiness advisor. It helps a contractor understand the DCAA audit report and contracting officer's determination, map the cited DFARS criteria, identify root causes, configure controls, and prepare the written response, corrective action plan, and supporting evidence. The contractor submits those materials to the contracting officer. Lightbridge does not issue a government finding, certify or approve a system, make the formal determination, administer withholding, represent contractors before DCAA, or conduct the official follow-up audit.

A material weakness needs evidence, not just a memo.

Lightbridge ERP helps root-cause the specific finding, reconfigure the control, and document the response as a vendor-neutral readiness advisor with no platform to sell.

Talk to an ERP advisor DCAA-compliant accounting