A CPA conducts. The AI assists. A human always signs.
How Scine & Associates uses artificial intelligence in DCAA-compliant accounting — and the controls that keep every number defensible, every dataset in scope, and every conclusion attributable to a licensed professional.
There are two loud answers in this market. Both are wrong.
The first says artificial intelligence will run your accounting department outright — no controller, no reviewer, no CPA, just a connection to your ledger and a monthly close that appears on its own. The second says AI has no business anywhere near a government contractor's books, and that the safe posture is to refuse it entirely. One of those answers will eventually cost you an audit finding. The other will cost you five years of competitive position.
We take a third position, and we take it deliberately. Artificial intelligence is a powerful instrument, and like every instrument in a professional practice, it produces value in proportion to the discipline placed around it. A spreadsheet does not make a rate defensible. Neither does a model. An indirect rate becomes defensible when a CPA can explain how it was built — which pool, which base, which allocation method, against which provision of FAR Part 31 — and is willing to stand behind that explanation in front of an auditor who is paid to disagree.
So we conduct. Every engagement at Scine & Associates has a named CPA who decides what work AI is permitted to touch, what data it is permitted to see, and what output is permitted to become part of your records. The technology accelerates the work. It does not own the work, and it does not sign the work. That distinction is the whole of our approach, and we believe it is where this industry is heading — not toward autonomy, and not toward abstention, but toward accountable acceleration.
The line is drawn in writing, not by instinct.
We publish this list because our clients — and their primes — are entitled to know exactly where the tooling starts and stops.
Where AI assists
- •First-pass extraction from source documents: vendor invoices, receipts, subcontractor billings, timesheets, and bank and credit card activity
- •Proposed transaction classification in the general ledger, reviewed line by line before anything posts
- •Anomaly and outlier detection across periods — surfacing what a human should examine, never deciding what it means
- •Reconciliation support across large datasets, including intercompany and multi-entity activity
- •Drafting narrative sections of management reports, budget commentary, and internal memoranda
- •Research assistance against FAR, DFARS, CAS, and agency guidance, with every citation verified against primary source before it reaches you
- •Building and stress-testing spreadsheet models, workpaper templates, and reporting formats
- •Summarizing long documents we already possess: contracts, modifications, prior audit correspondence
Where AI does not go
- •Final determination of cost allowability or unallowability under FAR Part 31
- •Indirect rate structure decisions: pool and base composition, allocation methodology, rate strategy
- •Anything transmitted to a contracting officer, DCAA, or DCMA without CPA review and signature — incurred cost submissions, ICS/ICE schedules, provisional billing rate proposals
- •Professional judgment: accruals, estimates, revenue recognition, reserve adequacy, going-concern assessment
- •Timekeeping compliance conclusions and floor-check readiness determinations
- •Advice you will rely on, in any form, that has not been read and adopted by the professional whose name is on it
- •Any decision that professional standards require a licensed human to make
Four steps, applied to every engagement, before a tool is ever opened.
Classify
Before any technology touches your data, we build a data map. What is Federal Contract Information. What is Controlled Unclassified Information. What is ordinary commercial financial data. What is personally identifiable information. The classification determines the toolset. The toolset never determines the classification.
Segregate
FCI and CUI stay inside systems that meet the bar your contract sets. Data that is not cleared for a given tool never reaches that tool. No client data is entered into consumer AI services, and no client data is placed in any service that trains its models on submitted content.
Supervise
AI output enters the workpaper as a proposal, never as a conclusion. A CPA or senior accountant accepts it, corrects it, or rejects it, and that review is documented in the file. Nothing reaches your financial statements on the strength of a machine's confidence.
Sign
A licensed professional takes responsibility for the result. When an auditor asks three years from now how a number was produced, the answer is a workpaper and a named human being — not a vendor, not a version number, and not a black box.
Security, CUI, and where CMMC actually stands
On July 13, 2026, the Department suspended CMMC Phase II — including the third-party assessment requirements that had been scheduled to begin November 10, 2026 — pending a reform review. A great deal of commentary has treated that as a reprieve. It is not one.
Phase I did not pause. Level 1 and Level 2 self-assessments remain required, along with annual affirmations and current scores posted to the Supplier Performance Risk System under DFARS 252.204-7019. NIST SP 800-171 Rev. 2 remains the operative baseline. The full weight of DFARS 252.204-7012 is untouched: adequate security for covered defense information, 72-hour incident reporting to DIBNet, media preservation, and flow-down to your subcontractors. And because the suspension binds the Department rather than your prime, primes remain free to impose the original requirements on your subcontract regardless.
Here is what that means for artificial intelligence, and it is the part most firms are not saying out loud. If your accounting workflow places CUI into a cloud service, that service is inside your assessment boundary. DFARS 252.204-7012 requires cloud services handling covered defense information to meet FedRAMP Moderate security requirements or their equivalent, along with the clause's incident reporting and forensic preservation obligations. An AI feature added to a platform you already use does not inherit an exemption because it is convenient, and it does not fall outside your boundary because a vendor's marketing page does not mention CMMC.
We scope that question before we answer any other one.
What that discipline looks like in practice
- •Data classification completed and documented per engagement, before tool selection
- •A written AI Use and Data Handling Policy, furnished on request to any client, prime, or contracting officer who asks for it
- •No client data submitted to consumer AI services, and none submitted to any service that trains on client content
- •Least-privilege access by named personnel, reviewed at onboarding and at offboarding
- •Multi-factor authentication across all systems holding client financial data
- •AI-assisted workpapers retained under the same retention schedule and review standard as every other workpaper in the file
- •A documented escalation path aligned to the 72-hour DIBNet reporting expectation applicable to your covered data
- •A client-level election: any client may limit or entirely eliminate AI assistance on their engagement, in writing, with no change in fee
Why "fully autonomous AI accounting" fails an audit
DCAA does not audit your software. It audits your records and your people.
Accounting system adequacy under DFARS 252.242-7006 turns on things a model cannot supply: proper segregation of direct and indirect costs, a functioning timekeeping system, documented internal controls, consistent treatment across periods, and the ability of a responsible person to explain and support a cost when challenged. "The system produced it" has never been a sufficient answer to an audit inquiry, and it will not become one.
Consider the actual timeline. An incurred cost submission filed this year may be audited three or four years from now. By then the model has been retrained, the vendor has changed its product, the feature you relied on may no longer exist, and the reasoning behind a classification exists nowhere in writing. What survives that gap is documentation and a professional who can reconstruct the judgment. Firms promising to replace your accounting function wholesale are selling speed today against a liability that lands after the contract term.
We would rather be the firm you can still explain in year four.
Frequently Asked Questions
Bring us the contract, and we will tell you what is actually required.
Most conversations about AI and compliance start in the abstract and stay there. Ours starts with your clause list, your data, and your prime's flow-downs. Thirty minutes, no charge, and you will leave with a clearer picture of your obligations whether or not you engage us.
Scine & Associates LLC — St. Augustine, Florida and Annapolis, Maryland. Outsourced accounting, fractional CFO services, and DCAA-compliant financial operations for government contractors, SBIR/STTR recipients, and growth-stage businesses.