The 19-section master file structure that survives every federal-audit pathway. DOL Davis-Bacon, DCMA pre-award, DCAA cost-realism, OFCCP affirmative action, SBA subcontracting, CMMC SPRS, IG, GAO, and FOIA. FAR 4.703 retention compliant.
Why this binder exists
Federal construction contracts come with one assumption baked into every clause: somebody is going to audit you. Not “if.” When. The contracting officer can request records under FAR 4.703 going back three years from project completion. The DOL Wage and Hour Division can open a Davis-Bacon investigation off a single anonymous tip. DCMA runs pre-award and post-award contractor surveys. DCAA examines indirect rates and timekeeping if you carry any cost-reimbursable work. OFCCP enforces affirmative-action obligations on contracts above the threshold. The DoD IG, agency IGs, and GAO all have jurisdiction to pull files for review. And any taxpayer can file a FOIA request against the contracting agency that forces production of records you provided. Most federal contractors think of “audit prep” as Davis-Bacon prep, and miss the other six pathways an auditor can come through your door.
The binder is the artifact that survives all of them. It’s not one checklist for one agency; it’s a master file structure that anticipates every federal-audit pathway and keeps the documents indexed in one place so that whichever letter arrives, the response window is hours instead of weeks. The 14-day DOL response window. The 5-day DCMA pre-award turnaround. The 30-day OFCCP compliance review submission. The 20-day FOIA acknowledgment. None of those windows are long enough to build a binder from scratch on an active project. They are barely long enough to pull pre-built sections out of an existing one.
What makes federal-construction audit prep different from any other kind of compliance work is the cross-agency overlap. The same change order that DCMA reviews for cost-realism is what GAO requests during a protest. The certified payroll record DOL examines is the same record that supports the eSRS subcontracting-plan report submitted to SBA. The CMMC SPRS score the contracting officer relies on is the document an IG investigation will pull during a cybersecurity incident. One binder, organized correctly, satisfies twelve different government readers. Built poorly, twelve different audits each become their own emergency.
The 2023 update to FAR 22.406 moved strict liability for sub-tier Davis-Bacon violations onto the prime regardless of knowledge. The 2025 CMMC final rule put SPRS scoring requirements on every DoD contract above the micro-purchase threshold. The Inflation Reduction Act and IIJA pushed federal-construction spending past $500B over five years, and DOL ‘s hiring of 100 additional Wage and Hour investigators in 2022 and 2023 explicitly tied that headcount growth to infrastructure-act audit volume. AGC’s quarterly compliance briefings now describe federal audit exposure as the single biggest unmodeled risk on most prime contractors’ P&Ls. The contractors winning federal work in 2026 are the ones treating audit-readiness as continuous infrastructure, not a fire drill. This binder is what continuous looks like.
This checklist is the master binder structure used by a large federal general contractor running 100,000 documents annually across DoD, USACE, GSA, VA, and federal-civilian work. Every section corresponds to a real audit pathway. Every item on a section is something a federal investigator, contracting officer, IG, or FOIA request actually asks for in the order they typically ask for it. Build the binder once. Maintain it weekly. Sleep through the next audit letter.
Who uses this
- Federal general contractors standing up an audit-ready binder before kickoff on a new prime contract
- 8(a) federal subs acting as primes on set-aside contracts who must satisfy SBA reporting plus the standard FAR audit pathways
- Compliance officers rebuilding a binder structure after staff turnover, ERP migration, or acquisition integration
- Project executives preparing a project closeout file that survives the three-year FAR 4.703 retention window
- Contract administrators maintaining the live binder during execution so the audit window stays measured in hours
What’s included. 19 binder sections covering every federal-audit pathway
The binder is organized into 19 sections. Every section is a tab, a folder, or a sheet. Depending on whether you maintain the binder physically, in a shared drive, or inside a compliance platform. Each item below is what an auditor will ask for, what triggers findings when missing, and what to keep behind the tab.
- Executed prime contract, all amendments, and clause matrix. Auditors start at the top of the file. Behind tab 1: the awarded prime contract with FAR clauses incorporated by reference, every bilateral modification (SF-30s) in chronological order, and a one-page clause matrix indexing the 30+ FAR/DFARS clauses that flow down. Missing modifications are the most common opening audit finding because they signal a contractor who isn’t tracking changes systematically.
- All subcontracts with FAR/DFARS flow-down clauses documented. Every subcontract above the simplified-acquisition threshold should be on file, executed, with the flow-down language explicit (not just “by reference”). Auditors will pick three random subs and trace the clause flow from the prime down to tier-2. Gaps in flow-down language are the second-most-common finding under FAR 52.244-5 and Davis-Bacon strict-liability frameworks.
- SF-1413 Statement and Acknowledgment for each sub. Required under FAR 22.406-1 for every Davis-Bacon-covered subcontract. The form proves the sub acknowledged the wage decision and the labor standards clauses. One per sub, executed before sub starts work, retained for three years post-completion. Missing SF-1413s are an automatic Davis-Bacon finding even if the sub paid prevailing wages correctly.
- Certified payroll archive (WH-347s). Full project window, prime + every sub. Three-year DOL retention requirement. Pull every weekly certified payroll from kickoff through current week, including no-work weeks, for the prime and every active sub. Index by project, sub, and week. Cross-reference each form to the wage decision attached to the contract. This is the section every Davis-Bacon audit opens with.
- Performance and payment surety bonds plus all bond riders. FAR 28.102 requires payment and performance bonds at 100% of the contract price on construction contracts above $150K. Behind this tab: original bond, every rider increasing penal sum after change orders, the surety’s power of attorney, and the ConsensusDocs or industry-standard bond form. Auditors verify that bond amounts kept pace with contract growth. A frequent gap on heavily modified contracts.
- Certificates of insurance plus endorsement schedule. ACORD 25 with all required coverages: GL, auto, workers comp, professional, pollution where applicable, and any contract-specific endorsements (waiver of subrogation, additional-insured language naming the government and prime). Renewal certificates filed in chronological order. Expired COIs in the active project file are the fastest path to a contract suspension.
- W-9 forms for every payee. Prime, subs, and material vendors above threshold. IRS-validated W-9s on file before first payment. Verify TIN format, signature, and exempt status. W-9 gaps trigger 1099 backup-withholding requirements and are the most common DCAA-incurred-cost-audit pickup item on cost-reimbursable federal work.
- Change order log. Directives, REAs, and equitable adjustments. Master log indexing every PCO, change directive, REA, and equitable adjustment with date issued, dollar value, status, and supporting cost-and-pricing data. DCMA reviews this for cost realism. GAO requests it during protests. Missing or out-of-sequence change orders are the single biggest signal to an auditor that the project’s cost records are unreliable.
- DCMA pre-award survey responses plus post-award contractor reports. If DCMA conducted a pre-award survey, retain the questionnaire response, the survey report, and any cure notices. Post-award: DCMA Form 1797 contractor performance reports and any letters of concern. This file is what GAO and the contracting officer’s source-selection authority will pull on the next bid.
- OFCCP affirmative-action plan plus EEO records. Required under EO 11246 for federal contractors above the threshold ($50K and 50 employees). Behind this tab: written AAP updated annually, applicant flow data, EEO-1 reports, employment activity logs, compensation analyses, and good-faith-effort documentation for veteran and disability hiring (VEVRAA, Section 503). OFCCP compliance reviews are scheduled every 3-5 years and require submission within 30 days of receipt.
- DOL audit-prep file. WH-347 backup, fringe-benefit allocations, apprenticeship records. Apprentice registration certificates with DOL or state agency, fringe-benefit plan documents and contribution records, daily site sign-in logs and time-keeping records, posted wage-decision photos with dates, and SF-1445 worker-interview forms if conducted. This is the supporting evidence layer underneath the WH-347 archive in section 4.
- Small-business subcontracting plan plus eSRS reports (SF-294 / SF-295). Required for contracts above $750K (or $1.5M for construction) with subcontracting opportunities. Behind this tab: the executed subcontracting plan, semi-annual SF-294 individual reports, annual SF-295 summary subcontract reports, and good-faith-effort documentation for missed goals. SBA can review compliance independently of the contracting agency, and findings flow to past-performance evaluations.
- CMMC SPRS scoring plus POA&M and System Security Plan (DoD contracts only). For DoD work above the micro-purchase threshold under the 2025 final rule: current SPRS score, supporting NIST 800-171 self-assessment or third-party assessment artifacts, POA&M with closure dates, System Security Plan, and supplier-flow CMMC compliance evidence for subs handling controlled unclassified information. CMMC findings now block contract award.
- SF-1444 monthly progress reports and USACE-specific submittals. USACE, NAVFAC, AFCEC, and similar agencies require contractor-specific monthly reporting on schedule, cost, safety, and quality. Maintain the report archive plus all government responses. Late or missing reports show up in CPARS and damage past-performance scoring on future bids.
- QA/QC daily reports plus three-phase quality control records. Three-phase QC (Preparatory, Initial, Follow-up) is mandatory on USACE and NAVFAC work and standard practice across federal-civilian. Behind this tab: signed Preparatory and Initial Phase checklists for each definable feature of work, daily QC reports, deficiency logs, and corrective-action records. Inspector-General reviews and CPARS quality scoring pull from this file.
- Safety records. OSHA 300/300A, EM 385-1-1 SSHP, and AHA archive. OSHA 300 logs and annual 300A summaries for the project window. The Site-Specific Safety and Health Plan (SSHP) approved per EM 385-1-1 for USACE work. Activity Hazard Analyses (AHAs) for every definable feature of work, signed by the affected crew before that work began. Tool-box talk records, accident reports, and near-miss logs. OSHA inspections, USACE safety reviews, and CPARS safety scoring all pull from here.
- Environmental compliance file. NEPA, Section 7, Section 106, Section 404 records. NEPA decision document (CatEx, EA/FONSI, or EIS/ROD). Section 7 ESA consultation records if endangered species are present. Section 106 NHPA cultural-resources consultation. Section 404 Clean Water Act permits. SWPPP and NOI/NOT records. Hazardous-materials manifests. EPA inspections and agency environmental reviews pull from this section, and findings can halt construction.
- FAR 4.703 records-retention log plus IG / GAO / FOIA response procedures. Master records-retention log identifying every record category, retention period (default three years post-final-payment), storage location, and destruction date if applicable. Written procedures for IG document requests, GAO protest responses, and agency FOIA requests including timeline, document-review attorneys, and privilege-log mechanics. Auditors love seeing a written procedure. It signals organizational maturity even before they review the records themselves.
- Designated audit-response liaison plus chain-of-command roster. One named individual as primary audit liaison with backup designated. Org chart showing the liaison’s reporting line to the contract program manager and corporate compliance officer. Contact info for outside audit counsel and the surety. The first 48 hours of an audit are about communication discipline. Knowing who talks to the investigator, who pulls records, and who clears responses materially shapes the outcome.
How to use the binder
Treat the binder as a living artifact. On contract award, build the empty binder structure first. All 19 tabs, named and indexed, before the first document goes in. Assign a section owner per tab; one person cannot maintain all of it. Run a binder review monthly during execution: walk every tab, mark each item Pass / Gap / Action, and assign closure deadlines for any Gap. Run a deep audit-readiness drill quarterly. Pretend the DOL letter arrived this morning, give yourself 14 days, see how close you actually are. Finally, on project closeout, freeze the binder in its closeout state and store under FAR 4.703 retention. The contractors who never get surprised by an audit are the ones who don’t wait for the letter to start the binder.
Stop fearing the audit letter.
The 19 sections in this binder are straightforward to maintain when records are indexed in real time. They become unmanageable when the audit letter arrives and the project team has 14 days to reconstruct a year of activity. Contracts Connected’s Compliance Dashboard keeps every certificate, certified payroll, change order, subcontract, COI, W-9, and compliance artifact indexed against the contract from the day work starts, so when the letter shows up from DOL, DCMA, OFCCP, the IG, or any FOIA requester, the binder is already built and the response is hours, not weeks.
For educational purposes. These templates, checklists, and trackers are operator-built starting points designed to help you move faster on the kind of work that usually drowns construction admins in email chains. They are not legal, insurance, accounting, or tax advice. Each project, jurisdiction, and contract has its own quirks. Review the document, refine the language, and consult your attorney, broker, CPA, or compliance officer before relying on it for a live project decision.
Frequently asked questions about federal-construction audit readiness
What federal agencies actually audit construction contractors?
The active list: DOL Wage and Hour Division for Davis-Bacon and related-acts compliance; DCMA for contract administration, cost-realism, and pre-award surveys; DCAA for indirect-rate and timekeeping audits on cost-reimbursable work; OFCCP for affirmative-action and EEO compliance; SBA for 8(a) and small-business subcontracting-plan compliance; the DoD IG, agency IGs, and GAO for fraud, waste, and abuse investigations; and the contracting officer’s own technical and contracting personnel for routine surveillance. FOIA requests can also force production of records to any requester. Treat all of them with the same binder.
How long must federal-construction records be retained?
FAR 4.703 sets the default at three years from the date of final payment. Some categories carry longer requirements: Davis-Bacon records (three years from project completion under DOL rules), OFCCP records (two years from action date or one year for contractors with fewer than 150 employees, longer if litigation pending), CMMC artifacts (six years per DoD policy), and any record involved in active litigation, audit, or investigation (held until the matter closes). When in doubt, hold longer. Storage is cheaper than reconstruction.
What’s the difference between a DCMA audit and a DCAA audit?
DCMA (Defense Contract Management Agency) administers the contract. Change orders, performance, technical compliance, schedule, quality. DCAA (Defense Contract Audit Agency) audits the financial side. Incurred costs, indirect rates, timekeeping systems, accounting-system adequacy. On firm-fixed-price construction work, DCMA is the active touch point. On cost-reimbursable or T&M work, DCAA also engages. Most federal-construction prime contractors will see DCMA on every project; DCAA only on the financial-instrument types where their jurisdiction triggers.
Does the prime really carry strict liability for sub-tier audit findings?
On Davis-Bacon, yes. FAR 22.406-9 and the 2023 DOL final rule explicitly placed strict liability on the prime for sub-tier wage violations regardless of knowledge. On other audit pathways, the prime’s exposure is contractual and operational rather than strictly statutory, but practically equivalent: a sub-tier finding on EEO, safety, environmental, or subcontracting-plan compliance flows to the prime’s CPARS scoring and past-performance record on future bids. The binder must include sub records, not just prime records.
What triggers a federal IG or GAO investigation versus a routine audit?
Routine audits run on schedule. DCMA pre-award surveys, OFCCP compliance reviews every 3-5 years, DCAA incurred-cost audits annually on cost-reimbursable work. IG investigations trigger from whistleblower complaints, hotline tips, fraud indicators, or referrals from contracting officers. GAO involvement most often follows bid protests but can also follow congressional inquiries. The procedural difference matters: routine audits have collaborative protocols; IG and GAO inquiries are adversarial and usually involve outside counsel from the first letter.
How fast must a federal contractor respond to an audit document request?
The standard windows: DOL Wage and Hour gives 14 days for most Davis-Bacon document requests. DCMA pre-award surveys typically request 5-10 business days. OFCCP compliance reviews require submission within 30 days. FOIA requests must be acknowledged within 20 working days under 5 U.S.C. 552(a)(6). IG and GAO subpoenas can be substantially faster, sometimes 48-72 hours. None of those windows are workable if the binder doesn’t already exist; they’re all manageable if the binder is current and indexed.