New FAR Rule on Compliance Programs and Ethics Mandates Comprehensive Internal Controls and Mandatory Disclosure of Violations and Overpayments

On November 12, 2008, the FAR Councils issued a final rule that further amends the FAR (Federal Acquisition Regulation) to amplify existing compliance program provisions (Subpart 3.10) and clauses (52.203-13 and 52.203-14). The rule also added requirements that contractors and subcontractors disclose certain violations of criminal law, violations of the civil False Claims Act, and significant overpayments.¹ The new rule took effect on December 12, 2008.

This new rule builds upon earlier compliance program requirements established in a December 2007 amendment to the FAR. The December 2007 amendment requires contractors and subcontractors receiving awards of contracts expected to exceed $5 million (including options)² and with a performance period of 120 days or more to:

• have a code of business ethics and conduct within 30 days of award
• implement a formal “awareness” or training program on the code within 90 days of award
• develop internal controls to support the code, also within 90 days of award
• display a hotline poster

The December 2007 amendment did not impose specific requirements for the training programs or internal control systems. As a result, the Department of Justice proposed an amended rule that provided more specific guidance on the required compliance programs. The DOJ compliance program proposal was based on the guidance on “effective” compliance and ethics programs issued by the United States Sentencing Commission.³

The new rule eliminates the previous exclusion of compliance program requirements for commercial item contracts and contracts that will be performed entirely outside the U.S.⁴ This change has widespread implications. For example, Federal Supply Schedule (FSS) contractors and contractors performing work in Iraq and Afghanistan will have to meet these requirements as well as the requirements specified in the new rule.⁵

Requirements of the New Rule

The new rule requires all contractors, even those that qualify as small businesses, that receive contracts and subcontracts in excess of $5 million (including options), with a performance period of 120 days or more to:

1. Have a written code of business ethics and conduct;
 
2. Make the code available to all employees involved in performance of the contract;

3. Exercise “due diligence” to prevent and detect improper conduct;

4. Promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law;

5. Timely disclose, in writing, to the agency Office of the Inspector General (OIG), with a copy to the contracting officer, whenever, in connection with the award, performance, or closeout of any government contract or subcontract, the contractor has credible evidence of a violation of federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code; or a violation of the civil False Claims Act (31 U.S.C. 3729 et seq) (emphasis added).

Note that under the new suspension and debarment provisions, contractors and subcontractors must make these disclosures on all existing contracts and subcontracts (including completed contracts and subcontracts within three years after final payment), regardless of whether the clause is included in the contract and regardless of the contract value or duration;⁶

6. “Fully cooperate” in government audits, investigations, or corrective actions relating to contract fraud and corruption.⁷ Thus, contractors and subcontractors are required to fully cooperate with the government in matters which must be disclosed.

The rule also provides that any contractor or subcontractor may be suspended or debarred for “knowing” failure by one of its “principals”8 to disclose a violation or to disclose significant overpayment(s) on the contract, other than overpayments resulting from contract financing payments.⁹ This applies to all contracts and subcontracts, regardless of whether the clause is included in the contract and regardless of the contract value or duration.¹⁰ This disclosure requirement applies to all existing contracts and subcontracts, including completed contracts and subcontracts within three years after final payment.

In addition to these requirements, the new rule also requires companies that do not qualify as small businesses to establish a business ethics awareness and compliance program with an internal control system to support it.

Requirement: Business Ethics Awareness and Compliance Program with Internal Controls System
 
Contractors (except small businesses) must have a business ethics awareness and compliance program that includes:

• Reasonable steps to communicate the contractor’s standards and procedures and other aspects of the ethics and compliance program through effective training programs and other dissemination of information appropriate to an individual’s roles and responsibilities

• Training requirements apply to the contractor’s principals, employees, and, when appropriate, to its agents and subcontractors
• Establishing detailed internal controls system within 90 days after contract award
• The internal control system must establish procedures to “facilitate timely discovery of improper conduct in connection with Government contracts.” This includes at a minimum:
  • assigning responsibility for oversight of the program at a sufficiently high level and providing adequate resources to ensure the effectiveness of the program;
  • making reasonable efforts to exclude individuals as principals who have engaged in conduct that violates the contractor’s code, i.e., don’t employ violators as managers or supervisors;
  • conducting periodic reviews of company practices, policies, procedures and internal controls for compliance with the code and the requirements of government contracting; this includes:
    • monitoring and auditing to detect improper conduct
    • periodic evaluation of the effectiveness of the program and internal control system
    • periodic assessment of the risks of improper conduct and implementation of appropriate steps to address the risks identified
  • establishing an internal reporting system that provides for anonymous or confidential reporting (when desired) of suspected improper conduct (e.g., hotline)
  • imposing a consistent system of disciplinary action for engaging in or failing to take reasonable steps to detect and prevent improper conduct, as well as incentives to encourage compliant behavior

 

 

 

• making timely disclosure of violations of federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations, or violations of the civil False Claims Act (described further below)¹¹

 

Note that a company may not qualify as a small business on all of its contracts. If it has at least one contract for which it does qualify as a small business, it must meet the foregoing requirements.

Requirement: Mandatory Disclosures

 

All contractors and subcontractors are required to disclose to the agency Office of Inspector General violations of federal criminal law involving fraud, conflict of interest, bribery, or gratuities or violations of the civil False Claims Act.¹²

When is disclosure required?
 
Disclosure must be made when a contractor or subcontractor has credible evidence that a principal, employee, agent, or subcontractor has committed a violation in connection with the award, performance, or closeout of a contract or subcontract thereunder.

• Contractors and subcontractors are required to report violations relating to any ongoing contract, even one that occurred prior to the effective date of the new rule, regardless of whether or not the clause is in the particular contract and whether or not an internal control system is in place.¹³
• The disclosure requirement for an individual contract or subcontract continues until at least three years after final payment on the contract.¹⁴

 

What is the timeframe for disclosure?
 
A contractor must make “timely” disclosure.

• There is no set time period for what constitutes “timely” reporting.
• Time for an investigation by the contractor is permitted. The FAR Councils state that the term “credible evidence” implies that a contractor will undertake a “preliminary examination of the evidence to determine its credibility before deciding to disclose to the Government.”¹⁵ Timeliness is generally measured from the date of determination of credible evidence. This raises issues for contractors or subcontractors who already have credible evidence of prior violations. Failure to timely disclose is grounds for suspension and debarment.

 

How is disclosure made?

In writing.

• Contractors should take care not to make inadvertent admissions of guilt or misconduct when making a disclosure. A contractor must disclose evidence that a violation occurred or may have occurred. It need not concede (unless it chooses to do so) that a violation actually occurred.
• Some agencies have posted on their Web sites disclosure forms that appear to require certification of the information included in the disclosure. But neither using an agency’s form nor certification of the disclosure is required under the new rule. Contractors may use the form as guidance about what information the agency expects to receive, but reformat their disclosure to protect themselves against inadvertent admissions of guilt or potential liability for a criminal false statement if there are any inaccuracies in the disclosure.
• All disclosures should bear proper restrictive legends that prevent public dissemination under the Freedom of Information Act, to the maximum extent possible.

 

To whom is disclosure made?
 
Disclosures should be made to the agency Office of the Inspector General with a copy to the contracting officer.¹⁶

What must be disclosed?
 
Violations of federal criminal law involving fraud, conflict of interest, bribery, or gratuities prohibited in Title 18 of the United States Code and violations of the civil False Claims Act (31 U.S.C. 3729 et seq).

What is “knowing” failure to disclose?

“Knowing” failure means actual knowledge of the violation on the part of one or more of the contractor’s or subcontractor’s principals, as defined in FAR 2.101. In other words, contractors must make written disclosures when a principal of the company has knowledge of a violation. Under the definition of “principal”, this could include compliance officers or directors of internal audits, as well as other positions of responsibility.¹⁷ “Until the contractor has determined the evidence to be credible, there can be no ‘knowing failure to timely disclose.’”¹⁸

Requirement: Full Cooperation

 

The new rule requires contractors and subcontractors to fully cooperate with the government in the government’s efforts to audit, investigate, or take corrective action relating to violations which must be disclosed. According to a newly added definition, “full cooperation” means “disclosure to the Government of information sufficient for law enforcement to identify the nature and extent of the offense and the individuals responsible for the conduct. It includes providing timely and complete response to Government auditors’ and investigators’ requests for documents and access to employees with information.”¹⁹

Full cooperation does not require:

• disclosure of information covered by the attorney client-matter privilege or work product doctrine; however, contractors are advised that facts are not protected and must be disclosed
• any officer, director, owner, or employee to waive his or her Fifth Amendment rights²⁰
  Contractors may conduct a thorough internal investigation and defend proceedings or disputes relating to potential or disclosed violations and still “fully cooperate.”²¹

Suspension and Debarment

 

The rule also provides that a contractor or subcontractor may be suspended or debarred for “knowing” failure by a principal to make the mandatory disclosures identified above, as well as failing to disclose significant overpayment(s) on the contract (other than overpayments resulting from contract financing payments as defined in FAR 32.001). This applies to all existing contracts and subcontracts (and those within three years after final payment), regardless of whether the clause is included in the contract and regardless of the contract value or duration.²² The FAR Councils rejected the argument that this new requirement is improperly retroactive. They noted that criminal violations and violations of the civil False Claims Act are already illegal and that the only change is the requirement to disclose the illegal behavior. However, this new ground for suspension or debarment also includes the failure to report “significant overpayments,” which the rule does not define. The FAR Councils indicated that this may not be based on monetary value alone, and what constitutes a “significant overpayment” will be determined by the suspension and debarment official.²³ (Contractors are already obligated to report and return overpayments under the payments clauses.)²⁴

Other Relevant Information

 

Confidential Information: The government is obligated, to the extent permitted by law, to safeguard and treat information obtained pursuant to the disclosure requirement as confidential when the information has been marked “confidential” or “proprietary” by the company.²⁵
 
Subcontractor Flow-Downs: The government requires prime contractors to flow-down the compliance clauses in all subcontracts expected to exceed $5 million and with a performance period of 120 days or more. This includes commercial item contracts and contracts performed outside the U.S. Prime contractors must only verify the existence of the subcontractor’s code, compliance program and internal controls, and need not review the program for adequacy.²⁶ As discussed above, subcontractors for which small business credit is being earned do not need to adopt a business ethics awareness and compliance program and internal control system.

Compliance Considerations in Performance Evaluations: The new rule also amends section 42.1501 (contractor performance information) to include compliance with contract requirements, cooperation with the government, and the contractor’s record of integrity and business ethics. Contractors can expect to see changes in performance evaluations based on the new rule.

Recommendations

 

Many contractors and subcontractors already have compliance and ethics programs that meet the Sentencing Guidelines criteria. Others have designed programs to meet the requirements of the December 2007 amendment, but have not implemented full Sentencing Guidelines programs. In any event, we recommend that contractors take the following steps:

1. Perform a Risk Assessment or Gap Analysis

All contractors should perform gap analyses/risk assessments to determine whether their programs meet the new requirements, and, if not, where they fall short. Some contractors will need to begin a program from scratch. Contractors should be aware that the grace periods established by the FAR – 30 days after contract award to implement codes of ethics and business conduct, and 90 days to implement training and internal control systems – are generally not sufficient to do a risk assessment and gap analysis, and to establish and implement a program. We recommend that contractors and subcontractors begin examining these issues now so that programs can be rolled out in a coherent and timely manner.

2. Comply With The “Look Back” Requirement

The other area that may cause contractors and subcontractors difficulty and place them at risk is the requirement to report prior violations about which they know, even when the contract in question does not contain the new compliance provisions. This “look-back” requirement applies to all current contracts as well as contracts for which the contractor has received final payment since December 12, 2005. Contractors should compile an inventory of all such contracts and engage in a due diligence process to determine whether any prior violations exist that must be reported. If the contractor had an adequate compliance program in place throughout the “look-back” period, no additional investigation may be necessary. If not, the contractor needs to develop and implement a process to ensure it learns of any reportable violations which its “principals” know about.

There is no doubt that the FAR Councils appropriately identified the requirements imposed by this new rule as a “sea change” for contractors performing work for the government. Contractors must be aware of, adjust to and comply with this sea change.

---

1 73 Fed. Reg. 67064, FAR Case 2007-006, Contractor Business Ethics Compliance Program and Disclosure Requirements (Nov. 12, 2008). 

2 The FAR Councils have also clarified that the $5 million trigger includes the anticipated dollar value of the contract, including options. 73 Fed. Reg. 67085. 

3 United States Sentencing Commission, Guidelines Manual, § 8B2.1 

4 73 Fed. Reg. 67090. 

5 The new rule has clarified that contractors have flexibility in the method of communicating the code of conduct. They are required to “make a copy of the code available to each employee engaged in performance of the contract.” 48 C.F.R. 52.203-13(b)(1)(ii). This will permit contractors to refer employees to Web sites and use other means of information technology rather than distributing paper copies. 

6 73 Fed. Reg. 67073, 67085.

7 The FAR Council indicates that this does not apply in the context of routine contract administration. 73 Fed. Reg 67078. 

8 “Principal means an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g. general manager; plant manager; head of a subsidiary, division, or business segment and similar positions).” 73 Fed. Reg. at 67091. 

9 Contract financing payments are defined in FAR 32.001, Definitions. 

10 73 Fed. Reg. 67085.

11 The training and internal control systems are not required on contracts with small businesses or for commercial items, as defined in FAR 2.101. 

12 48 C.F.R. 52.203-13(b)(3). 

13 73 Fed. Reg. 67074. 

14 73 Fed. Reg. 67092. 

15 73 Fed. Reg. 67073. 

16 On contracts used by multiple agencies, such as the Federal Supply Schedule, the rule requires making disclosures to the OIG for the ordering agency and the OIG of the agency responsible for the basic contract. 

17 See 73 Fed. Reg. 67079. 

18 73 Fed. Reg. 67074. 

19 48 C.F.R. 52.203-13(a). 

20 48 C.F.R. 52.203-13(a)(2). 

21 48 C.F.R. 52.203-13(a)(3). 

22 73 Fed. Reg. 67085. 

23 73 Fed. Reg. 67080. 

24 See e.g., 52.232-25, 52.232-26, 52.232-27, and 52.212-4(i)(5). 

25 48 C.F.R. 52.203-13(b)(3)(ii). 

26 73 Fed. Reg. 67084.