A contractor purchasing system review (CPSR) evaluates how efficiently and effectively a government contractor spends government money and complies with policy when subcontracting. Many contractors call it a “DCAA purchasing system audit,” but for most Department of Defense contractors the review is led by the Defense Contract Management Agency (DCMA), with DCAA supporting on cost and accounting questions.
Key Takeaways
- The Administrative Contracting Officer (ACO) decides whether a CPSR is needed. The cognizant contract administration office, which for most DoD contracts is DCMA, conducts it.[1]
- The ACO must consider a CPSR when a contractor’s covered sales to the government are expected to exceed $25 million over the next 12 months. Competitively awarded fixed-price contracts and commercial sales are excluded from that figure.[1]
- After the initial determination, the ACO must decide at least every three years whether another review is needed.[1]
- Under DFARS 252.242-7005, a material weakness in a single business system can lead to 5% payment withholding, capped at 10% across multiple systems.[2]
- Common findings involve transaction-level documentation: price analysis, competition records, clause flow-down, and records that reconcile to the accounting system.
Your purchasing system is under scrutiny, and the rules on who reviews what, and when, are easy to confuse. This article explains how DCMA and DCAA divide the work, what triggers a review, what reviewers look for, what happens when a system is found inadequate, and how to prepare.
Who Conducts a Purchasing System Review: DCMA or DCAA?
DCMA leads the CPSR. Under FAR 44.302, the ACO determines whether a review is needed, and the cognizant contract administration office performs it.[1] For most DoD contracts, that office is DCMA.
DCAA’s role is financial. It audits whether costs claimed on government contracts are allowable, allocable, and reasonable, through work such as incurred cost audits and forward pricing reviews. The two agencies’ work overlaps on purchasing:
- Subcontract costs: DCAA asks whether subcontract costs are supported. DCMA asks whether the purchasing process that produced them was compliant.
- Pricing documentation: DCAA examines cost or pricing data. DCMA examines whether the purchasing system required and kept that data.
- Internal controls: DCAA assesses accounting system controls. DCMA assesses purchasing controls. A weakness in one often prompts a closer look at the other.
That overlap is why a purchasing system gap, such as missing price analysis on a subcontract, can resurface as questioned costs in a later DCAA incurred cost audit covering the same period.
What Triggers a CPSR?
The ACO decides whether a CPSR is needed based on the contractor’s past performance and the volume, complexity, and dollar value of its subcontracts. The rule sets one clear checkpoint: if a contractor’s sales to the government are expected to exceed $25 million in the next 12 months, the ACO must perform a review to determine whether a CPSR is needed.[1]
Several details matter when estimating whether you are near that line:
- Sales exclude competitively awarded firm-fixed-price contracts, competitively awarded fixed-price contracts with economic price adjustment, and sales of commercial products and services under FAR Part 12.[1]
- Sales include prime contracts, subcontracts under government prime contracts, and modifications.[1]
- A CPSR generally reviews the contractor’s purchasing system as a whole, not one specific contract.[1]
- The agency head responsible for contract administration can raise or lower the $25 million level.[1]
Once the initial determination is made, the ACO must reassess at least every three years whether another review is necessary.[1] Reviews can also happen sooner if risk factors change, such as a sharp rise in subcontracting or prior findings.
What Reviewers Evaluate
For DoD contracts that include DFARS 252.244-7001, Contractor Purchasing System Administration, reviewers assess the purchasing system against the criteria in that clause.[3] In practice, they sample purchase orders and subcontract files to check that the system produces compliant outcomes, not just compliant policy language.
Contractors should be able to show:
- Written, current purchasing policies and procedures
- Competition records, or a documented justification for each sole-source award
- Price or cost analysis tied to specific transactions, not summary statements
- Required FAR and DFARS clauses flowed down to subcontracts
- Documented evaluation of subcontractor capability and risk
- Consent-to-subcontract and advance notification records where the contract requires them
- An approval authority structure and segregation of duties in the purchasing workflow
- Purchase records that reconcile to the accounting system, from order to invoice to payment
Common Purchasing System Deficiencies and How to Fix Them
Common findings involve transaction-level documentation gaps rather than bad intent. The table below covers the deficiencies contractors most often need to address before a review.
| Deficiency | What reviewers look for | Corrective action |
|---|---|---|
| Missing price reasonableness support | Written price or cost analysis in the file before award | Require documented analysis using catalog, historical, or competitive pricing for each applicable order |
| Weak competition documentation | Evidence of competition, or a sole-source rationale based on necessity | Add market research and a written justification to every non-competitive file |
| Missing flow-down clauses | Required FAR and DFARS clauses in subcontracts | Maintain a clause matrix and update it at each prime contract award |
| Outdated policies and procedures | Procedures that reflect current regulations and actual practice | Review procedures on a set cycle with version control |
| Incomplete consent files | Timely consent requests and written approvals where required | Track consent requirements in the purchase order workflow |
| Records that don’t reconcile | A traceable link from purchase order to invoice to cost ledger | Integrate purchasing and accounting data and test reconciliation regularly |
What Happens If a Purchasing System Is Found Inadequate?
The purchasing system is one of six contractor business systems covered by DFARS 252.242-7005. That clause applies to covered contracts subject to the Cost Accounting Standards.[2] The process works like this:
- Initial determination. If the contracting officer initially determines that a business system has one or more material weaknesses, the contractor has 30 days to respond in writing.[2]
- Final determination and withholding. If the final determination confirms material weaknesses, it includes a notice to withhold 5% of progress payments, performance-based payments, and interim cost vouchers.[2]
- Corrective action plan. Within 45 days of the notice, the contractor must either correct the weaknesses or submit an acceptable corrective action plan with milestones. If the plan is accepted and being implemented effectively, withholding for those weaknesses drops to 2%.[2]
- Release. Once the contractor reports that the weaknesses are corrected, the contracting officer decides whether to release the withheld funds. If no decision is made within 90 days, withholding is reduced by at least 50%.[2]
| Situation | Withholding under DFARS 252.242-7005 |
|---|---|
| Material weaknesses in one business system | 5% maximum |
| Material weaknesses in multiple business systems | 10% maximum in total |
| Accepted corrective action plan being implemented | Reduced to 2% for the covered weaknesses |
| All material weaknesses corrected | Withholding discontinued and withheld funds can be billed |
Source: DFARS 252.242-7005.[2]
How to Prepare for a CPSR
- Estimate your covered sales. Confirm whether you are likely to cross the $25 million review level in the next 12 months, using the FAR exclusions.
- Run a gap analysis early. Test a sample of your own purchase orders and subcontracts against the DFARS 252.244-7001 criteria months before a review is expected.
- Fix the documentation, not just the policy. Reviewers sample transactions, so every file needs its price analysis, competition record, and clause flow-down.
- Test the reconciliation. Make sure each purchase order traces cleanly to the invoice, payment, and cost ledger.
- Assign owners. Give each control a named owner who keeps evidence current between reviews.
- Get specialist input. A government contracts compliance advisor can confirm which clauses apply to your contracts and review your procedures before DCMA does.
Where Transportation Spend Fits
Freight, parcel, and 3PL services can form part of a contractor’s purchased-cost environment, making accurate invoice records and reconciliation important supporting documentation.
FreightOptics is not a CPSR or government compliance service. It covers one specific slice of the record: it audits transportation and 3PL invoices against the applicable contracts, flags billing errors and duplicates, and keeps an invoice-level audit trail. Contractors can use those records as supporting documentation for the transportation portion of their purchasing and accounting records.
Frequently Asked Questions
Does DCAA or DCMA conduct purchasing system reviews?
For most DoD contracts, DCMA conducts the CPSR as the cognizant contract administration office, and the ACO decides whether a review is needed.[1] DCAA audits costs and accounting systems and can support the review.
What is the CPSR threshold?
The ACO must review whether a CPSR is needed when a contractor’s covered sales to the government are expected to exceed $25 million in the next 12 months.[1] Competitively awarded fixed-price contracts and commercial sales are excluded.
How often are purchasing systems reviewed?
After the initial determination, the ACO must decide at least every three years whether another review is necessary.[1]
What happens if a purchasing system has a material weakness?
The contracting officer can withhold 5% of payments for material weaknesses in one business system, up to 10% across multiple systems. An accepted corrective action plan that is being implemented reduces that to 2% for the covered weaknesses.[2]
What are common audits conducted by DCAA?
DCAA commonly performs incurred cost audits, forward pricing audits, and audits of contractor business systems such as accounting and estimating systems. Its findings can inform a DCMA purchasing system review.
Close Purchasing System Gaps Before the Review
A purchasing system review tests whether your procurement controls are consistent, traceable, and documented at the transaction level. Treating compliance as a continuous discipline makes documentation, control gaps and corrective actions easier to address before a review. Review your purchasing system against the current FAR and DFARS criteria now, with specialist help where you need it.
For the transportation slice of that record, see how FreightOptics audits freight and 3PL invoices against your contracts.
