Contractor Purchasing System Review (CPSR) support

What a CPSR is, and what sets one off

A CPSR is the government’s full assessment of how you buy material and services and manage subcontracts, from the requirement through subcontract completion. DCMA’s CPSR Group does the fieldwork. Your contracting officer, usually the ACO, requests it and decides whether to approve the system.

For DoD, the ACO determines whether you need one once sales to the government are expected to exceed $50 million over the next 12 months. The codified DFARS already used $50 million in place of the codified FAR’s $25 million. The rewritten FAR Part 44 drops the dollar figure and leaves it to judgment: past performance and the volume, complexity and dollar value of your subcontracts. After a first review, the question comes back at least every three years.

DCMA’s guidebook also expects at least one prime contract with FAR 52.244-2 and has left competitive fixed-price and commercial sales out of the count. The deviation text doesn’t repeat that exclusion, so we confirm with the ACO how sales are measured.

One change matters for venture-backed companies. Section 1826 of the FY2026 NDAA exempts nontraditional defense contractors (10 U.S.C. 3014) from the requirement to maintain an acceptable purchasing system, and DoD’s Part 44 deviation puts it into effect. The head of the contracting activity can waive it in writing. Check whether you qualify before you build for a review.

The Review

What the auditor actually looks at

Here’s how the review plays out, from DCMA’s public CPSR Guidebook and our experience on both sides of government reviews.

Reviews come in four types: initial, comprehensive (for an approved system, typically every three years), special, and follow-up after a disapproval. About 90 days out, the analyst starts requesting information: your government contract list, a questionnaire, and the universe, meaning every purchasing transaction in a 12-month period. The sample comes from that universe across dollar levels, so large subcontracts and routine purchase orders both get pulled.

The review, virtual or on site, opens with an entrance briefing. Questions come in writing on a numbered log, and DCMA expects answers within 24 hours or notice of a delay. The lead analyst holds daily briefings, then an exit briefing where deficiencies are stated formally.

The guidebook splits the review into 30 elements, each with a policy test and a practice test. Your manual has to say the right thing, and your files have to show you did it. In a sampled file, analysts typically check:

• Competition or justification. Was it competed? If not, is there a management-level sole-source justification written before award?
• Price reasonableness. For awards without adequate competition, a price or cost analysis that states the method, the data used, and the conclusion.
• Flowdowns. The mandatory FAR and DFARS clauses for that prime contract and subcontract type, current at award, and only the permitted clauses on commercial subcontracts.
• Exclusion checks. Evidence the supplier wasn’t debarred, suspended, or proposed for debarment when you awarded.
• Certified cost or pricing data. When required, obtained and certified, using the right threshold for that prime contract.
• Special requirements. FFATA subaward reporting, counterfeit electronic part controls, and the rationale behind commercial item determinations for subcontracted items.

Outside the files, they look at buyer training records, internal audits or self-reviews, procurement authority levels, and small business subcontracting plan compliance. DCMA’s guidebook calls missing training documentation a common problem.

Deficiencies come back as a Level II Corrective Action Request, and you have 30 calendar days to answer with root cause, corrective actions and a corrective action plan. That answer feeds the CPSR report and the contracting officer’s initial determination, so it deserves as much care as the files.