Every DCAA (Defense Contract Audit Agency) audit, whether requested or self-initiated, begins with a risk assessment. A risk assessment is a set of tools auditors – all auditors – use to help decide where and what to focus on in an audit. So, for example, if only $100 of material costs have been charged against a $1 million contract, the auditor would probably conclude that his/her limited resources can be better spent on other than material costs.
Typically, incurred cost audits and audits of interim requests for payment (i.e. voucher reviews) are performed