New FAR Rule on Compliance Programs and Ethics Mandates Comprehensive Internal Controls and Mandatory Disclosure of Violations and Overpayments
November 21, 2008
Richard O. Duvall- Northern Virginia
Allison V. Feierabend- Washington
Steven Gordon - Washington
Christopher Myers- Northern Virginia
Final Rule Issued
On November 12, 2008, the FAR (Federal Acquisition Regulation) Councils issued a final rule that further amends the FAR to amplify existing compliance program provisions (Subpart 3.10) and clauses (52.203-13 and 52.203-14). The rule also adds requirements that contractors and subcontractors disclose certain violations of criminal law, violations of the civil False Claims Act, and significant overpayments.1 The new rules take effect on December 12, 2008.
This final rule builds upon earlier compliance program requirements established in the December 2007 amendment to the FAR. That rule requires contractors and subcontractors receiving awards of contracts expected to exceed $5 million (including options)2 and with a performance period of 120 days or more to do the following:
- have a code of business ethics and conduct within 30 days of award
- implement a formal “awareness” or training program on the code within 90 days of award
- develop internal controls to support the code, also within 90 days of award
- display a hotline poster
The December 2007 final rule did not impose specific requirements for the training programs or internal control systems. As a result, the Department of Justice proposed an amended rule that provided more specific guidance on the required compliance programs. The DOJ compliance program proposal was based on the guidance on “effective” compliance and ethics programs issued by the United States Sentencing Commission.3
The new rule eliminates the previous exclusion of compliance program requirements for commercial item contracts and contracts that will be performed entirely outside the United States.4 This change has widespread implications. For example, FSS contractors and contractors performing work in Iraq and Afghanistan will have to meet these requirements, as well as the new requirements specified in the final rule.5
Requirements of the New Rule
The new rule requires contractors to:
- Establish a business ethics awareness and compliance program and internal control system, which includes requirements to: (1) have a written code of business ethics and conduct, (2) make the code available to all employees involved in performance of the contract, (3) exercise “due diligence” to prevent and detect improper conduct, and (4) promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law.
- Timely disclose in writing, to the agency Office of the Inspector General, with a copy to the contracting officer, whenever, in connection with the award, performance, or closeout of any government contract or subcontract, the contractor has credible evidence of a violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code; or a violation of the civil False Claims Act (31 U.S.C. 3729 et seq) (emphasis added). Note that under the new suspension and debarment provisions, contractors and subcontractors must make these disclosures on all existing contracts and subcontracts (including completed contracts and subcontracts within three years after final payment), regardless of whether the clause is included in the contract and regardless of the contract value or duration;6
- “Fully cooperate” in government audits, investigations, or corrective actions relating to contract fraud and corruption.7 Thus, contractors and subcontractors are required to fully cooperate with the government in matters that must be disclosed.
The rule also provides that any contractor or subcontractor may be suspended or debarred for the “knowing” failure by one of its “principals”8 to disclose a violation or to disclose significant overpayment(s) on the contract, other than overpayments resulting from contract financing payments.9 This applies to all contracts and subcontracts, regardless of whether the clause is included in the contract and regardless of the contract value or duration.10 This disclosure requirement applies to all existing contracts and subcontracts, including completed contracts and subcontracts within three years after final
payment.
1. Business Ethics Awareness and Compliance Programs
Under the final rule, contractors must include the following in its business ethics awareness and compliance program:
- Reasonable steps be taken to communicate the contractor’s standards and procedures, as well as other aspects of the ethics and compliance program, through effective training programs and other dissemination of information appropriate to an individual’s roles and responsibilities
- Training requirements that apply to the contractor’s principals, employees, and, when appropriate, to its agents and subcontractors
- A detailed internal controls system that must be established within 90 days after the awarding of a contract
- The internal control system must establish procedures to “facilitate timely discovery of improper conduct in connection with Government contracts.” This includes at a minimum:
1) Assigning responsibility for oversight of the program at a sufficiently high level and providing adequate resources to ensure the effectiveness of the program
2) Making reasonable efforts to exclude individuals as principals who have engaged in conduct that violates the contractor’s code, i.e., don’t employ violators as managers or supervisors
3) Conducting periodic reviews of company practices, policies, procedures and internal controls for compliance with the code and the requirements of government contracting. This includes monitoring and auditing to detect improper conduct; periodic evaluation of the effectiveness of the program and internal control system; and periodic assessment of the risks of improper conduct, and implementation of appropriate steps to address the risks that have been identified.
(4) Establishing an internal reporting system that provides for anonymous or confidential reporting (when desired) of suspected improper conduct
(e.g., a hotline).
(5) Imposing a consistent system of disciplinary action for engaging in or failing to take reasonable steps to detect and prevent improper conduct, as well as incentives to encourage compliance behavior.
(6) Making timely disclosure of violations of Federal criminal law involving fraud, conflict of interest, bribery or gratuity violations, or violations of the civil False Claims Act (described further below).11
2. Mandatory Disclosures
All contractors and subcontractors are required to disclose to the agency Office of Inspector General (OIG) violations of federal criminal law involving fraud, conflict of interest, bribery, or gratuities or violations of the civil False Claims Act.12
When is disclosure required?
- Disclosure must be made when a contractor or subcontractor has credible evidence that a principal, employee, agent, or subcontractor has committed a violation in connection with the award, performance, or closeout of a contract or subcontract thereunder.
- Contractors and subcontractors are required to report violations relating to any ongoing contract, even one that occurred prior to the effective date of the new rule, regardless of whether or not the clause is in the particular contract and whether or not an internal control system is in place.13
- The disclosure requirement for an individual contract or subcontract continues until at least three years after final payment on the contract.14
What is the timeframe for disclosure?
A contractor must make “timely” disclosure.
- There is no set time period for what constitutes “timely” reporting.
- Time for an investigation by the contractor is permitted. The FAR Councils state that the term “credible evidence” implies that a contractor will undertake a “preliminary examination of the evidence to determine its credibility before deciding to disclose to the Government.”15 Timeliness is generally measured from the date of determination of credible evidence. This raises issues for contractors or subcontractors who already have credible evidence of prior violations. Failure to timely disclose is grounds for suspension and debarment.
How is disclosure made?
In writing.
To whom is disclosure made?
Disclosures should be made to the agency Office of the Inspector General (OIG) with a copy to the contracting officer.16
What must be disclosed?
Violations of Federal criminal law involving fraud, conflict of interest, bribery, or gratuities prohibited in Title 18 of the United States Code and violations of the civil False Claims Act (31 U.S.C. 3729 et seq).
What is “knowing” failure to disclose?
“Knowing” failure means actual knowledge of the violation on the part of one or more of the contractor’s or subcontractor’s principals, as defined in FAR 2.101. In other words, contractors must make written disclosures when a principal of the company has knowledge of a violation. Under the definition of “principal,” this could include compliance officers or directors of internal audits, as well as other positions of responsibility.17 “Until the contractor has determined the evidence to be credible, there can be no ‘knowing failure to timely disclose.”18
3. Full Cooperation
The new rule requires contractors and subcontractors to fully cooperate with the government in the government’s efforts to audit, investigate, or take corrective action relating to violations that must be disclosed. According to a newly added definition, “full cooperation” means “disclosure to the government of information sufficient for law enforcement to identify the nature and extent of the offense and the individuals responsible for the conduct. It includes providing timely and complete response to government auditors’ and investigators’ requests for documents and access to employees with information.”19
Full cooperation does not require disclosure of information covered by the attorney client-matter privilege or work product doctrine. (Contractors are advised that facts are not protected and must be disclosed, however.) In addition, an officer, director, owner or employee is not required to waive his or her Fifth Amendment rights.20
Contractors may conduct a thorough internal investigation and defend proceedings or disputes relating to potential or disclosed violations and still “fully cooperate.”21
4. Suspension and Debarment
The rule also provides that any contractor or subcontractor, regardless of size, may be suspended or debarred for “knowing” failure by a principal to make the mandatory disclosures identified above, as well as for failing to disclose significant overpayment(s) on the contract (other than overpayments resulting from contract financing payments as defined in FAR 32.001). This applies to all existing contracts and subcontracts (and those within three years after final payment), regardless of whether the compliance clause is included in the contract and regardless of the contract value or duration.22
The FAR Councils rejected the argument that this new requirement is improperly retroactive. They noted that criminal violations and violations of the civil False Claims Act are already illegal, and that the only change is the requirement to disclose the illegal behavior. However, this new ground for suspension or debarment also includes the failure to report “significant overpayments,” which the rule does not define. The FAR Councils indicated that this may not be based on monetary value alone, and what constitutes a “significant overpayment” will be determined by the suspension and debarment official.23 (Contractors are already obligated to report and return overpayments under the payments clauses.)24
5. Other Relevant Information
- Confidential Information: The government is obligated, to the extent permitted by law, to safeguard and treat information obtained pursuant to the disclosure requirement as confidential when the information has been marked “confidential” or “proprietary” by the company.25
- Subcontractor Flow-Downs: The government requires prime contractors to flow-down the compliance clauses in all subcontracts expected to exceed $5 million and with a performance period of 120 days or more. This includes commercial item contracts and contracts performed outside the United States. Prime contractors must only verify the existence of the subcontractor’s code, compliance program, and internal controls, and need not review the program for adequacy.26
- Compliance Considerations In Performance Evaluations: The new rule also amends FAR 42.1501 (contractor performance information) to include compliance with contract requirements, cooperation with the Government, and the contractor’s record of integrity and business ethics. Contractors can expect to see changes in performance evaluations based on the new rule. If so, this may provide an additional ground in bid protests.
Conclusion
Many contractors and subcontractors already have compliance and ethics programs that meet the Sentencing Guidelines criteria. Others have designed programs to meet the requirements of the December 2007 final rule, but have not implemented full Sentencing Guidelines programs. We recommend that all contractors perform gap analyses/risk assessments to determine whether their programs meet the new requirements, and, if not, where they fall short. Some contractors will need to begin a program from scratch. Contractors should be aware that the grace periods established by the FAR – 30 days after contract award to implement codes of ethics and business conduct, and 90 days to implement training and internal control systems – are generally not sufficient to do a risk assessment and gap analysis, and to establish and implement a program. We recommend that contractors and subcontractors begin examining these issues now so that programs can be rolled out in a coherent and timely manner.
The other area that may cause contractors and subcontractors difficulty and place them at risk is the requirement to report prior violations about which they know, even when the contract in question does not contain the new compliance provisions.
For more information, contact:
Christopher A. Myers
703.720.8038
chris.myers@hklaw.com
Richard O. Duvall
703.720.8620
richard.duvall@hklaw.com
Steven D. Gordon
202.457.7038
steven.gordon@hklaw.com
Allison V. Feierabend
202.457.7169
allison.feierabend@hklaw.com
toll free: 1.888.688.8500
1 73 Fed. Reg. 67064, FAR Case 2007-006, Contractor Business Ethics Compliance Program and Disclosure Requirements (Nov. 12, 2008).
2 The FAR Council has also clarified that the $5 million trigger includes the anticipated dollar value of the contract, including options. 73 Fed. Reg. 67085.
3 United States Sentencing Commission, Guidelines Manual, § 8B2.1
4 73 Fed. Reg. 67090.
5 The new rule has clarified that contractors have flexibility in the method of communicating the code of conduct. They are required to “make a copy of the code available to each employee engaged in performance of the contract.” 48 C.F.R. 52.203-13(b)(1)(ii). This will permit contractors to refer employees to websites and use other means of information technology rather than distributing paper copies.
6 73 Fed. Reg. 67073, 67085.
7 The FAR Councils indicate that this does not apply in the context of routine contract administration. 73 Fed. Reg 67078.
8 “Principal means an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager; head of a subsidiary, division, or business segment and similar positions).” 73 Fed. Reg. at 67091.
9 Contract financing payments are defined in FAR 32.001, Definitions.
10 73 Fed. Reg. 67085.
11 The training and internal control systems are not required on contracts with small businesses or for commercial items, as defined in FAR 2.101.
12 48 C.F.R. 52.203-13(b)(3).
13 73 Fed. Reg. 67074.
14 73 Fed. Reg. 67092.
15 73 Fed. Reg. 67073.
16 On contracts used by multiple agencies, such as the Federal Supply Schedule, the rule requires making disclosures to the OIG for the ordering agency and the OIG of the agency responsible for the basic contract.
17 See 73 Fed. Reg. 67079.
18 73 Fed. Reg. 67074.
19 48 C.F.R. 52.203-13(a).
20 48 C.F.R. 52.203-13(a)(2).
21 48 C.F.R. 52.203-13(a)(3).
22 73 Fed. Reg. 67085.
23 3 Fed. Reg. 67080.
24 See e.g., FAR 52.232-25, 52.232-26, 52.232-27, and 52.212-4(i)(5).
25 48 C.F.R. 52.203-13(b)(3)(ii).
26 73 Fed. Reg. 67084.