A construction audit is an independent review of the financial records, contracts, and internal controls tied to a capital project, carried out to confirm that every dollar billed to the owner is legitimate, properly documented, and permitted under the contract. It covers vendor invoices, labor time records, equipment charges, change orders, procurement practices, and overhead allocations. For an owner, the point is recovering overcharges and tightening controls before more money goes out. For a contractor, a clean result protects the working relationship and demonstrates financial integrity.
The audit is not a general inspection of the work in place. It is a financial and contractual review, and its reach is defined almost entirely by one clause in the construction contract.
The Audit Clause Controls Everything
No clause, no audit. The right to review a contractor’s books does not exist by default on a private project. It has to be written into the agreement before construction begins, and the specifics of that clause determine how deep the auditor can go, how long records must be kept, and who pays for the review if overcharges surface.
A well-drafted clause spells out which cost categories are subject to review, what records the contractor must maintain, how much advance notice the owner must give, and how long the contractor must preserve documentation after final payment. Some clauses add a cost-shifting provision: if overcharges exceed a stated percentage of total billings, the contractor reimburses the owner for the audit itself. Owners who skip the clause or accept vague language (“owner may audit contractor’s records”) usually discover the gap only after a dispute, when their leverage has already evaporated.
Federal Projects
On federally funded work the audit right is not optional. The Federal Acquisition Regulation requires cost-reimbursement, incentive, time-and-materials, and similar contracts to include a clause granting the contracting officer access to all records “sufficient to reflect properly all costs claimed to have been incurred or anticipated to be incurred directly or indirectly in performance of this contract.”1Acquisition.GOV. Audit and Records-Negotiation Records is defined broadly: books, documents, accounting procedures, and computer data. The clause extends to subcontracts above the simplified acquisition threshold, currently $350,000.2Acquisition.GOV. Threshold Changes – October 1st, 2025 Federal contractors must keep records available for three years after final payment, and longer if the contract was terminated or if claims or litigation remain unresolved.3Acquisition.GOV. Subpart 4.7 – Contractor Records Retention The Comptroller General has independent authority to examine records and interview employees about contract-related transactions.
Private Projects
Private construction contracts have no equivalent mandate. Rights depend entirely on what the parties negotiate. Standard industry forms sometimes grant the owner’s designated auditor the right to examine contractor and subcontractor records for a specified number of years after final payment, but the useful clauses go further, listing specific cost categories subject to review and any categories excluded. Vague language invites arguments about scope and produces less useful audits.
How Contract Type Shapes the Scope
The kind of contract in place determines how deep the audit will go and where the money at risk actually sits.
- Cost-reimbursable (cost-plus): the contractor bills actual costs plus a fee, and the owner carries the risk on every line item. These carry the highest audit exposure. The auditor examines individual invoices, time records, equipment charges, and overhead allocations, testing whether each cost was actually incurred, properly allocated to the project, and reasonable.
- Guaranteed maximum price (GMP): similar to cost-plus but capped. The audit focuses on whether the contractor hit the cap legitimately or shifted costs between categories to obscure overruns. Where savings below the GMP are shared, the auditor verifies the shared-savings math.
- Fixed-price (lump-sum): the contractor bears the cost risk, so the owner’s audit interest is narrower. Reviews focus on change orders, unit-price adjustments, and milestone payments. The auditor generally cannot demand the contractor’s internal cost records on the base contract work because the owner already agreed to a fixed price.
Most construction audits target cost-plus and GMP work because those structures give the owner the most exposure and the strongest contractual ground to demand transparency.
What the Auditor Actually Looks At
Scope is tailored to the contract and the owner’s concerns, but a few categories show up in nearly every engagement.
Cost Verification
This is the core of the work. Every cost billed must pass three tests: it is allowed under the contract, it is chargeable to this project rather than the contractor’s general business, and it is reasonable compared to what a prudent business would pay. Auditors trace direct costs (materials, labor, equipment) back to original vendor receipts and verify approval chains. Indirect costs, sometimes called general conditions, get scrutinized for proper allocation. Contractors sometimes spread general corporate overhead across multiple projects, effectively shifting operating expenses onto one owner’s budget.
Change Orders
Change orders are one of the most audit-sensitive areas on any project. The auditor checks whether each change was priced according to the contract’s procedures, approved before work began, and marked up within the agreed limits. Many contracts cap markup on self-performed change order work at around 10 percent of direct costs and limit markup on subcontracted work to roughly 5 percent. When those limits exist, auditors frequently find markups applied to cost categories the contract excludes, or percentages calculated on a base that improperly includes items already covered by overhead.
Equipment Charges
Equipment is a common source of overbilling, partly because there is no single universal rate standard. For federally funded work, the Federal Highway Administration methodology uses the Rental Rate Blue Book, calculating an hourly rate from the monthly rate divided by 176 hours plus hourly operating costs, adjusted for equipment age and region.4EquipmentWatch. Rental Rate Blue Book / Cost Recovery FEMA publishes its own schedule of equipment rates for disaster-related work, covering ownership and operation costs but excluding operator labor.5FEMA. Schedule of Equipment Rates On private projects, auditors compare billed rates to those benchmarks or to third-party rental market data.
The Blue Book rates are designed to let an equipment owner recover ownership and operating costs. They do not include profit, project overhead, or general company overhead, and by coincidence they might match a third-party rental company’s rate, but that is not their purpose.4EquipmentWatch. Rental Rate Blue Book / Cost Recovery Auditors who understand the distinction can spot contractors billing at third-party rental rates for equipment they already own, pocketing the spread.
Related-Party Transactions
Transactions involving the contractor’s affiliated companies get special attention. When a contractor steers work to a company it owns or controls, the usual competitive pressure on pricing disappears. Auditors test whether related-party charges reflect actual market rates and whether the contractor disclosed the relationship as the contract required. Inflated related-party pricing is one of the more profitable findings in construction audits because the markups can be substantial and the documentation trail is usually clear.
Internal Controls
Beyond individual transactions, the auditor evaluates whether the contractor’s internal processes are strong enough to prevent errors and fraud in the first place. The key control is segregation of duties: the person who authorizes a purchase should not be the person who processes payment. Auditors also look for patterns that suggest controls have been sidestepped, such as a cluster of invoices just under the dollar threshold that triggers a second approval signature.
How the Audit Runs
A construction audit typically takes about three months from kickoff to final report: roughly four weeks of planning, four weeks of fieldwork, and four weeks of report preparation. Larger or more complex projects take longer, and audits that surface significant issues may extend fieldwork.
The process starts when the owner issues a formal notification letter to the contractor, citing the specific audit clause, identifying the time period under review, and specifying the records needed. That letter establishes the legal basis for the engagement. An initial planning meeting covers logistics: where the auditors will work, what format the records should be in, and a realistic timeline.
Fieldwork
During fieldwork, auditors sample from the full population of project transactions, focusing on high-dollar items, unusual entries, and the categories flagged as high-risk during planning. The core exercise is reconciling the contractor’s internal cost reports with the invoices submitted to the owner, then tracing individual charges back to vendor receipts, purchase orders, and approvals. Specialized software analyzes the general ledger data and flags anomalies: duplicate invoice numbers, charges posted after the contract period, vendors with no corresponding purchase order, cost codes that do not match the type of work described.
Interviews fill in what the documents cannot. Auditors talk to project managers about purchasing and staffing, to accounting staff about approval workflows, and to procurement personnel about bidding and vendor selection. Site visits verify that equipment or materials listed on invoices actually exist on the project. An auditor who sees a piece of equipment sitting idle for weeks may question the billed hours.
Draft Findings and Response
After fieldwork, the audit team compiles preliminary observations into a draft findings document and presents it to the contractor’s management. This is the contractor’s opportunity to respond, produce missing documentation, or dispute factual conclusions. The back-and-forth here matters. A finding based on a missing invoice that the contractor can actually produce gets resolved at this stage rather than inflating the final report.
Final Report
The final report describes the audit’s scope, methodology, and conclusions. It usually opens with an executive summary, then works through detailed findings. Each finding quantifies the financial impact, presents supporting evidence, and includes a recommendation.6National Association of Construction Auditors. What Is Involved in a Construction Audit Contractor management may be asked to sign a written representation letter confirming that all records and related-party information were made available, that no transactions went unrecorded, and that no undisclosed side agreements exist.7Public Company Accounting Oversight Board. AS 2805: Management Representations That letter is not a formality; it creates a documented record that becomes significant if undisclosed issues later surface.
What Auditors Typically Find
Construction audits uncover a fairly predictable set of problems.
Straightforward billing errors are the most common: duplicate invoices, charges for unallowable costs like personal expenses or corporate entertainment, and misapplied overhead rates. A recurring issue is a fixed overhead percentage applied to cost categories the contract explicitly excludes. On a large project these add up quickly, and they are usually the easiest recoveries to document and collect.
Procurement failures come next. Many contracts require competitive bidding for subcontracts and major purchases above a stated threshold. When the contractor skips the bidding process or steers work to an affiliated entity without demonstrating best value, the auditor flags the price differential as a potential recovery. Missed volume discounts and vendor rebates that should have benefited the owner also land here.
Labor and payroll are high-risk because time tracking is inherently messy and classification errors are easy to make. Auditors commonly find workers billed at a higher rate than their actual classification warrants, time charged for employees who were not on the project, and unsupported time records. On cost-reimbursable contracts, general corporate staff time is often improperly charged to the project, shifting the contractor’s operating costs onto the owner.
Davis-Bacon on Federal Work
Federally funded construction projects exceeding $2,000 must pay workers no less than the locally prevailing wages and fringe benefits for their classification. On prime contracts exceeding $100,000, overtime rules require at least one-and-a-half times the regular rate for hours worked beyond 40 in a week.8U.S. Department of Labor. Davis-Bacon and Related Acts Contractors submit weekly certified payrolls with a signed statement confirming that each worker received the applicable wage rate and that no impermissible deductions were made.9Acquisition.GOV. 52.222-8 Payrolls and Basic Records Auditors cross-check the certified payrolls against actual payroll records, looking for misclassifications that underpay workers or, on the other side, classifications that inflate billable rates above prevailing wage levels. Underpayment violates the law; inflated classification on a cost-reimbursable contract means the owner overpaid.
What Overcharges Cost
When the audit identifies overcharges, recovery depends on the project’s status and the nature of the finding.
On an active project, the most common approach is a contract offset: the owner reduces future payments by the documented overcharge amount. If the project is complete, the contractor repays the owner directly. Some audit clauses shift the cost of the audit itself to the contractor when overcharges exceed a specified percentage of total billings, which gives the contractor a financial reason to keep the records accurate from the start.
Federal Consequences
On government-funded work the stakes rise sharply. Contractors who knowingly submit false claims to the federal government face liability under the False Claims Act, which imposes treble damages (three times the government’s actual loss) plus a civil penalty for each false claim submitted. The statutory penalty range of $5,000 to $10,000 per claim is adjusted annually for inflation, pushing the current figures considerably higher. A contractor who cooperates early, discloses the violation within 30 days, and has no knowledge of an existing investigation may see damages reduced to double rather than triple, which is still a severe outcome.10Office of the Law Revision Counsel. 31 USC 3729 – False Claims
Beyond money, federal agencies can suspend or debar contractors who commit fraud, falsify records, make false statements, or engage in bribery or embezzlement connected to a government contract.11Acquisition.GOV. 9.406-2 Causes for Debarment Debarment is not technically punishment; it is a determination that the contractor is not “presently responsible” enough to do business with the government. The effect is devastating anyway: a debarred contractor loses access to all federal contracting for the debarment period, and many state and local agencies honor federal debarment lists.
Getting Ready for an Audit
Whether you are the owner initiating the review or the contractor being reviewed, preparation determines how smoothly the process runs and how much it costs.
For the owner, the formal notification letter drives the schedule. It should cite the audit clause, define the period under review, and list the records required. An early planning meeting sets expectations about cooperation, workspace, and format.
For the contractor, the single most useful step is designating one point of contact to coordinate with the audit team. That person manages the flow of documents, schedules interviews, and keeps auditors from pulling different staff away from their jobs with overlapping requests.
Document organization is where audits succeed or stall. The contractor should assemble general ledger extracts, labor time records, original vendor invoices, change order logs, executed subcontracts, and insurance certificates into a structured, searchable format. A secure, centralized data room gives auditors access to sensitive financial records without exposing the company’s broader systems. Disorganized records do more than slow things down. Auditors may treat missing or unfindable documents as control deficiencies in the final report.
A preliminary internal review of high-risk areas before the auditors arrive is worth the time. Checking overhead allocation methods, related-party documentation, and change order pricing against the contract terms lets you identify anything unusual and prepare an explanation. Finding a problem yourself is always better than having an auditor find it for you.
How Long to Keep the Records
Record retention determines whether an audit is even possible. On federal contracts, the baseline is three years after final payment, with extensions for terminated contracts and unresolved claims or litigation.3Acquisition.GOV. Subpart 4.7 – Contractor Records Retention Private contracts vary widely depending on the clause negotiated. Some standard forms specify three years; others extend much longer.
Regardless of the contractual minimum, holding construction records past that floor is generally the safer call. Latent defect claims, warranty disputes, and tax audits can surface years after a project closes, and the records that support or defeat those claims are the same ones a construction auditor would review. Destroying records at the earliest permitted date saves storage costs and eliminates your ability to defend charges later.