The Pentagon put AI on every computer. Your DCAA auditor is on it too.

The Defense Contract Audit Agency has now published two accounts of branch offices putting AI on audits, one week apart. The first, on Sept. 8, 2026, described two incurred cost audits its Nashville Branch Office completed for the Department of Energy. The numbers are the agency's own:

And this is how the agency says it got there:

Read the three uses separately, because they are three different things. Large-scale data analytics is a screening tool. Customized testing procedures is audit program design. Automating manual and time-consuming processes is throughput. A contractor facing the first one gets more questions; facing the second one gets different questions; facing the third one gets them sooner. The same article adds that the team used custom data analytic software to target higher-risk accounts without sacrificing accuracy and excellence, which is the sentence that should matter most to whoever owns the incurred cost submission: risk targeting is the step that decides which of your accounts gets opened.

One week later, on Sept. 15, 2026, the agency published a second account, from a different office and on a different kind of engagement. It opens on the scope: DCAA's New York Branch Office audit team demonstrated exceptional performance on a series of complex incurred cost and forward pricing rate audits for a major contractor. The method is in the second paragraph.

New York goes further than Nashville in two places that matter to a contractor. The first is the population. 100 percent of indirect expenses, across numerous accounts, is not a sample; it is the whole population, and the analytics is what let the team spend its judgment on the higher-risk areas afterward. What the full pass turned up was expressly unallowable costs, which is the one category of questioned cost that carries a penalty under FAR 42.709 when it reaches a final indirect cost rate proposal.

The second is what the AI was pointed at. In Nashville it ran the analytics and wrote the test procedures. In New York the auditors used it for regulatory research, and the finding it sped up was a Cost Accounting Standards noncompliance. That is the auditor using a model to build the regulatory side of the finding, the half a contractor has traditionally assumed it could out-research.

It is worth being precise about what these stories are and are not. They are two branch offices, on a handful of engagements: two incurred cost audits for a civilian customer in Nashville, and a series of incurred cost and forward pricing rate audits for one unnamed contractor in New York. They are not a statement that every DCAA audit now runs this way. But two accounts of the same method, a week apart, is the agency choosing to publicize it, which is what organizations do with practices they intend to spread. New York's account says so in as many words: the team established a strategic foundation for more productive and efficient future engagements.

DCAA's Annual Report to Congress FY 2025 carries a section headed Leveraging Technology to Enhance DoW Resource Allocation and Efficiency. It is short, and it is the most quoted thing in this piece for a reason: it is the agency telling Congress, in writing, what artificial intelligence did for it.

Take that sentence apart before repeating it. $36.8 million in savings for every hour worked is an efficiency ratio, and its denominator is hours worked on targeted contract reviews, not hours worked on audits. It is not a return on investment figure, and it is not comparable to the agency-wide claim the Director makes in the same report's transmittal letter:

Those are program-wide figures over $788 billion in contract costs, and the $7.5 for every $1 spent is a ratio of savings to budget. The AI figure is neither. What the AI sentence does say, and this is what makes it worth reading closely, is that DCAA is prepared to attribute a specific dollar outcome to deploying artificial intelligence and large language models, in a report submitted to the congressional defense committees. That is a commitment, and organizations that make one in writing tend to extend the programme rather than quietly drop it.

The second half of the sentence is the operational one: over $6 billion identified by reallocating funds, cancelling unneeded obligations and halting a major program extension is not an audit exception. It is money found by looking across contracts at once, which is exactly the kind of work that gets cheap when the screening is automated and expensive when it is not.

The report's Summary of Recommendations section is where the machinery behind those figures is described, and it is the paragraph to read twice.

Four things are named there, and only one of them is AI. A data lakehouse is where the agency puts its own audit history so it can be queried across engagements. The War Data Platform is enterprise data from across the Department. Guardrails is governance. The AI sits on top of all three, and the sentence says so: the data work is the foundation that lets the AI be expanded. That ordering is the thing to notice, because it means the capability compounds. An agency that has consolidated its own audit results can ask questions it could not ask before, whether or not a language model is involved.

The same section notes that DCAA added provisional billing rate submissions to its contractor portal, automating a previously manual process and resulting in greater efficiency and faster establishment of billing rates. That is a small line with a direct consequence: a submission that arrives as structured data is a submission that can be screened before a human opens it.

On Dec. 9, 2025 the U.S. Department of War stood up the environment its whole workforce now works in.

The next day, the Secretary of War emailed the whole workforce, and posters went up around the Pentagon. Joint Base San Antonio carried the Pentagon News account of it.

That is not a pilot being offered. It is an expectation being set, in writing, by the head of the Department, for every member of it. The same account is precise about who that covers and how they get in: access to the site is available only to personnel with a common access card and who are on the War Department's nonclassified network. DCAA is a Department of War agency, reporting to the Under Secretary of War (Comptroller), and its auditors carry that card and work on that network.

The launch release is equally precise about what the environment is cleared for, which is the sentence that decides whether any of this can touch your data.

Two things in that screenshot are worth more than the whole marketing paragraph around them. The first is the banner, which is the control that makes the accreditation real to a user: a green banner at the top of the page reminds users of what can and can't be shared on the site. The second is what the tool says it can do. Asked how it would help the Department achieve its mission, it replied with a list of capabilities, including, among other things, creating and refining documents, analyzing information, processing and analyzing satellite images, and even auditing computer code for security purposes. The capability table on screen names document interrogation, extracting and analyzing key information from uploaded documents, and data analysis.

Now read that list as a contractor rather than as a reader. An incurred cost submission is a set of uploaded documents. A general ledger is data to be analyzed for trends. Retrieval-augmented generation, named in the launch release, is precisely the technique for grounding a model in a specific body of documents rather than in its training. Point that at a proposal, a ledger and a set of audit programs and you have described the tool an auditor would want, in the environment their employer has told them to use daily.

The platform has kept growing since. On Aug. 31, 2026 the Department added a second capability, and its release described what that one is for.

An audit file is document-heavy unclassified work. So set the records beside each other and the picture is coherent rather than speculative: the Department has fielded an accredited enterprise platform and says AI capabilities have now reached all desktops in the Pentagon and in American military installations around the world. It has told every member of the workforce to make it part of their daily routine, and the Department is providing no-cost training for GenAI.mil to all DoW employees. DCAA, an agency inside that Department, reports using generative AI on audits and is scaling a programme of its own with guardrails around it. A contractor planning for the next audit should plan on the assumption that the auditor has a capable assistant in an approved environment.

What the releases do not say is how many people have actually picked it up. That was said on the record at DefenseTalks, the conference DefenseScoop hosts, where James Mazol, the Department's deputy under secretary for research and engineering, said that 1.7 million of our 3 million [personnel] have used GenAI.mil and the frontier models that we have on that, and then put a number on how many of them are using it in earnest.

Three other lines in the same report bear on an audit. The first is who the platform is for: the department first introduced its GenAI.mil platform for service members, DOD civilians and contractors in December to provide access to commercial tools that can assist with back-office functions and other tasks. Contractors are named beside service members and civilians, which makes this the Department's workforce tool in the broadest sense rather than a niche one an audit agency happens to have. The second is what is on it. Last month, the Pentagon announced that Grok and ChatGPT had been added to the portal, which also features Gemini. An auditor on the platform is not choosing between an approved tool and a capable one.

The third is where the use is heading. Earlier this year, a senior DOD official said that the workforce had used GenAI.mil to create 100,000 agents to help them do their jobs. Cameron Stanley, the Pentagon's chief digital and AI officer, said at the same conference that the department is now looking at how to change its approach to integrating agents and mapping agentic workflows. An agent is a model given a task and the tools to carry it out in steps, and an audit step is exactly that shape: pull the population, test it against a criterion, write up what does not pass. Mazol also said the models are moving past the unclassified network: we're going to proliferate frontier models, not just on our controlled unclassified network, but also SIPR, which is secret, and then JWICS for top secret, and into [Special Access Programs] as well. That part matters less to a contract audit, which is unclassified work, than the adoption figures do.

These are officials speaking at a public conference as a trade outlet reported them, not a Department release, so each span is attributed to the outlet that printed it. None of them mentions DCAA by name. What they establish is the scale of the environment DCAA's auditors work in, stated by the people who run it.

In plain terms, these are three of the best-known AI chat tools, from three different companies, all inside a platform the Department has cleared for controlled unclassified information. They are not limited to a demonstration room. The post tells the workforce that anyone on a government computer can use them today. DCAA's auditors work in that Department, on those computers, so whoever audits your submission can use any of the three.

DCAA's Strategic Plan FY 2026-2030 sets out three goals. The Director's message lists them, and the third is Capitalize on Technological Innovation. The goal page itself is headed CAPITALIZE ON TECHNOLOGICAL INNOVATIONS, and the statement under it is the clearest one-sentence description of where this is going.

A five year plan is a slow document and it is easy to discount. What makes this one worth reading is that the plan's own Key Accomplishments page already claims the work as done rather than planned, and it does so on a tile that says the quiet part plainly.

The same page carries a second tile, and it is the deterrence claim: In FY 2025, over $3.8 billion in unallowable costs were voluntarily removed before the audits began. Set the two tiles beside each other and the strategy is visible. Deterrence works when contractors believe the review will find things. Better screening makes that belief better founded, and better founded belief removes more cost before anybody opens a file. The AI is not only an audit tool. It is also an argument aimed at the contractor community.

And it is not a DCAA-only conversation. In August the agency hosted the second annual Department of War Audit Conference at the Pentagon, with the Deputy Under Secretary of War (Comptroller) opening on removing operational barriers, adopting new technology, and embracing a culture of shared accountability. DCAA reported what the afternoon was about: the afternoon sessions focused on modernization and technology, featuring a panel on how data and artificial intelligence transform audit oversight, allowing defense agencies to increase speed and accuracy with the help of technology. The audience for that panel was the Department's whole audit community, DCAA alongside the Office of Inspector General, the Army Audit Agency, the Naval Audit Service and the Air Force Audit Agency.

It is also talking to the other side of the table about it. DCAA is on the agenda at The Redstone Edge Conference 2026 in Huntsville, Alabama on September 22, 2026, an annual event for professionals in government contracting, with a session called Modernizing Audits: DCAA's Approach to Data Analytics, AI, and Automation. When an audit agency books a continuing-education slot to explain its own methods to the people it audits, the polite reading is transparency. The practical reading is that it expects the room to prepare for what it is about to do.

Job announcements are an unconventional source of insight, but often a revealing one. They are written to recruit rather than to inform, and they are the only public place an agency writes down what a role will actually do before the role exists. Across 2,497 DCAA announcements opened between February 2, 2017 and September 3, 2026, 13 are analytics or AI roles, 12 of them findable by their title alone and one only by its duties. DCAA has published the key duties of every one of them.

Read the duties rather than the titles and three things come out of that list that no press release says.

The analytics is ordinary statistics, and it is aimed at your numbers. The specialist role is not speculative data science. DCAA describes it this way: Implements DCAA objectives and provides technical support and guidance in the use of data analytics. Utilizes quantitative methods (QM) such as statistical sampling, regression/correlation analysis, and improvement curve techniques. Statistical sampling, regression and improvement curves are the tools an auditor uses to test a proposal and to project a sample across a population, and this is a role whose whole job is to push them out to the field.

What they build gets written into the manual your auditor follows. The same posting says the specialist creates and maintains Agency-wide data analytics techniques, Power BI data models, and assists to maintain the OTS Data Analytics SharePoint site. More consequentially, the same role monitors and updates all DCAA data analytics audit procedures to include, but not limited to the Contract Audit Manual (CAM), the Data Analytic Guidebook and best practices/how-to videos on the intranet. A 2022 data scientist posting closes the loop on the training side: that role leads teams consisting of Defense Contract Audit Institute (DCAI) course developers and course managers to improve and create courses that ensure new and revised data analytic techniques are integrated into DCAI training. So the technique does not stay in a lab. It becomes guidance in the Contract Audit Manual and a course at the Defense Contract Audit Institute, which is how it reaches the auditor who opens your file.

The AI work is scoped, staffed and pointed at the audit environment. Two postings four years apart carry it, and they are worth reading in DCAA's own words rather than paraphrased. The first stood up a branch and said what the branch was for. The manager hired to run it was to supervise a specialized team consisting of Operations Research Analyst, Data Scientist, and Technical Specialist.

Four years later the question had moved to the working level, in a posting whose title names nothing at all. This one says what the AI is being evaluated against, and what it runs on.

The data scientist advertised a day later puts the last piece on the org chart.

Two words in there deserve a second look. A Chief Digital and AI Office division sits on DCAA's own org chart, which is the same office the Department says is scaling its platform. And unstructured is the operative word: a general ledger is structured, but a contract file, an exit conference note and a basis of estimate are not, and those are the documents an audit actually argues over.

One more line says the quiet part. The branch manager was to provide technical advice, guidance, training, documentation, and direction on a wide range of data related concerns which may be internal to DCAA or external with the contractor community. The data function was scoped from the start to face the contractor community, not just DCAA's own auditors.

None of this changes the laws and regulations. FAR 31.201-2 still decides whether a cost is allowable, and it decides it on reasonableness, allocability, the cost principles and the terms of the contract, in that framework and no other. An audit exception is still sustained or not on the strength of the record. What changes is volume, speed and targeting, and each one has a different consequence.

Expect more questions, on more accounts. Screening at the scale of a general ledger means the sampling judgment that used to limit an audit is doing less work. Accounts that were immaterial in a sample are reachable in a full pass, and a full pass is no longer hypothetical: New York tested 100 percent of the indirect expenses it was auditing.

Expect the questions sooner, and in a batch. Automation compresses fieldwork. A schedule that used to give you a month between requests can give you a week, and a response process that depends on one person recalling the answer will not keep up. The New York team used a shared portal for information requests, ensuring all parties remained informed and aligned, which also means every request and every response time sits on a record both sides can see.

Expect the screening to be keyword-shaped. This is the one contractors can actually act on. A screen over account descriptions and journal entry memos is a screen over the words your own people typed. An entry described as an entertainment accrual, a lobbying retainer or a settlement reads as a finding whether or not the underlying cost is unallowable, and the burden of showing otherwise lands on you.

The answer still has to be authority. A questioned cost is answered by the cost principle as it stood at award, by what DCAA itself has directed its auditors to do, and by how the boards and the courts have ruled on the same issue. Faster questions do not make that work smaller. They make it the part of the process that is under strain, and the auditor is now doing that research with AI too, so a response built from memory is arguing against one built from the regulation.

It is worth seeing what that work is actually worth, because questioned costs are not findings until someone upholds them. Take Ology Bioservices, Inc., ASBCA No. 62633, decided May 20, 2021. It is an incurred cost case, and it is the shape of dispute this whole article is about: the contracting officer found that the contractor had exceeded the executive compensation cap and had included expressly unallowable costs of $1,749,890 for its chief executive in its indirect cost rate proposal. The CO found that $979,938 of this amount was allocated to covered contracts and assessed Ology a penalty in this amount, and she demanded interest that brought the total government claim to $1,109,160.

The appeal turned on a single question that no amount of screening speed would have settled: which year's cap applied. The contractor certified its fiscal 2013 proposal before the government had published a fiscal 2013 cap, and the government assessed the penalty by applying the prior year's figure. The Board did not agree.

Read that against everything above. The questioned cost was real, the audit found it, and the contractor still won, because the government carried a burden it could not meet on a figure the regulation refers to and never states. Faster analytics would not have changed that outcome by a dollar. What decided it was knowing which year's cap governed a proposal certified before that year's cap existed, which is exactly the kind of question that gets answered from the regulation and the case law rather than from a ledger.

That is the shape of the problem: a faster screen on one side of the table, and on the other an answer that still has to be built from authority. We build both halves into GovConDash, and they are worth describing concretely rather than as a pitch, because the second one is the unusual half.

Ledger Scan reads your ledger the way a screening tool would. It runs a versioned catalog of 351 screened terms over account names, descriptions and journal entry memos: 211 of them are cost terms that carry a regulatory reference and are questioned in dollars, and 140 are risk terms that carry none and are surfaced for auditor inquiry only, never as a questioned cost. The catalog cites 28 FAR sections across 46 cost principles, and every one of its 235 verified references names a section that exists in the regulation corpus rather than a citation somebody typed. The point is not to find unallowable costs for you. It is to see what an automated screen would flag before someone else runs one, so the documentation exists before the question arrives.

The DCAA Audit Response Builder drafts the answer from authority, not from memory. Upload the draft audit report, the Form 1 or the questioned cost schedule and it reads the auditor's own words first, lifting the assignment number, the cited sections and the amounts before a model is asked anything. Then, over 8 steps, it reaches 24 grounded tools and takes a concede, rebut or negotiate position on each finding, with every assertion tied to a source you can open. See a full run of the DCAA Audit Response Builder, step by step.

The order on that pyramid is the whole design. The regulation comes first, and it comes in two forms: the current text, and the text as it stood on the contract's own award date, which is the difference between a correct answer and a confidently wrong one on any cost principle that has been amended. DCAA's own guidance comes next, because an auditor works from an audit program and a manual, and an answer that engages the program the assignment number names lands differently from one that does not. Then the forums, in order of weight: the Board by the section a decision actually cited, the Court of Federal Claims and the Civilian Board of Contract Appeals as persuasive authority, and the Federal Circuit at the apex, whose precedential decisions bind every forum below it.

Two of the tools compute rather than retrieve, and both exist because these are the two places a response goes wrong arithmetically. One resolves the FAR 31.205-6 compensation cap for the award date and the agency, a figure the regulation refers to and never states. The other works the FAR 42.709 penalty exposure, which is the number that decides whether a finding is a disagreement or a problem.

Everything above is DCAA getting better at reading what you send it. There is a proposal on the table that would change what it is reading. On August 20, 2026 the Deputy Secretary of War signed a memo resetting the Department's expectations for supplier cost and pricing data, and Breaking Defense, which reviewed it, reported what is in it.

The memo's own words, as the outlet printed them, are narrower and more concrete: this approach will establish Application Programming Interfaces to pull cost information directly from contractors' enterprise resource planning or other financial systems. And the scope is not a pilot program. Full transparency throughout all tiers of the supply chain applies to all contractors and subcontractors, the memo says, and this requirement supports negotiations for products and services valued at $10 million or more, regardless of whether cost and pricing data requires certification. ExecutiveGov read the same document the same way: Feinberg's transparency directive would extend to every tier of the supply chain for contracts of $10 million or higher, whether or not certified cost and pricing data is required.

Set that beside the rest of this article and the picture completes itself. An agency that has built a data lakehouse, hired a branch to run analytics, stood up a CDAO division and put generative AI on incurred cost audits is an agency with somewhere to put a direct feed from your accounting system. The screening described in section 06 stops being a pass over what you chose to submit and becomes a pass over what your system holds.

Now the caveats, and they are substantial enough that nobody should be redesigning their ERP this quarter.

It is a memo, not a rule. Nothing here has been through rulemaking, no FAR or DFARS text has changed, and the memo does not lay out a plan for implementing or financing this "automated solution," and it is not clear whether its adoption would result in additional cost to industry.

Industry has already objected, on the record. The Aerospace Industries Association told the same outlet that this approach risks adding years to acquisition timelines, creating new barriers to delivering critical capabilities to our troops, and undermining Congress' recent modernization efforts.

The most informed read is the least dramatic one. John Ferrari, a retired Army major general and a senior fellow at the American Enterprise Institute, told the outlet that this does not necessarily say the Pentagon's going to reach in through the machine and pull it out. Ferrari said the software would likely be used to standardize and streamline how the Pentagon gets cost information from companies, with artificial intelligence potentially being used to help comb through data. That is a standardized submission with AI on the receiving end rather than a Pentagon terminal inside your general ledger, and it is the version a contractor should plan for.

And this is the weakest evidence in this article. The memo is not public. Both outlets are reporting on a document their own authors reviewed, and one of them is reporting on the other, so every span above is attributed to the outlet that printed it rather than to the Department. Everywhere else in this article, DCAA, the Department of War and the Board speak for themselves, a job announcement DCAA wrote does, or, in section 03, named officials speaking on the record do; this section is the one place nobody does, and it is placed last for that reason.