June 29, 2007

Proposed FAR Contractor Code of Ethics Requirements: How Could These Affect You?

Holland & Knight Alert
Christopher A. Myers

The federal government is considering amending the Federal Acquisition Regulation (FAR) to require certain contractors to have a code of ethics, as well as an ethics and compliance training program and an internal control system. The public was given the opportunity to submit comments on the proposed rule, and the comment period ended on May 23, 2007. This alert includes discussion and analysis of the following:

1) the terms of the proposed FAR amendment

2) the major concerns raised in the comments that were submitted

3) recommendations for government contractors in light of the likely outcome of the regulatory process

One thing seems clear: although the comments raise a number of substantial and legitimate concerns, it is virtually certain that some version of this proposal is likely to be adopted. In light of this reality, government contractors should evaluate their existing ethics and procurement procedures and identify potential weaknesses in light of the proposed rule. After doing some analysis of these issues, contractors should consider modifications that would bring their own compliance and ethics framework and procedures in line with the standards that already exist for effective compliance and ethics programs.

Proposed FAR Rule on Code of Ethics and Internal Controls

The new rule would apply to contracts with all agencies for noncommercial items exceeding $5 million, with performance periods of 120 days or more. Any contractor falling under the proposed new rule would be required to do the following:

1) display the agency Office of Inspector General (OIG) Fraud Hotline poster at its U.S. work sites and on the company’s intranet

2) have a written code of ethics and business conduct within 30 days of award

3) establish an employee ethics and compliance training program within 90 days of award

4) establish an internal control system within 90 days of award

The proposed rule states that a company’s employee training program and internal controls should be appropriate for and proportionate to the size of the company and the extent of the company’s government contracts business. Among the requirements of an internal control system are the following:

  • periodic assessments of the company’s compliance policies and procedures
  • internal and external audits
  • an internal hotline for employees to report possible improper conduct
  • disciplinary action for improper conduct

The proposed rule would flow down to subcontracts for noncommercial items that exceed $5 million. Violations of the rule would be punishable by the withholding of contract payments or the loss of award fee.

The current draft of the proposed rule exempts commercial item contracts or those contracts performed outside the United States from the hotline poster and ethics requirements.

Comments on Proposed FAR Rule

More than a dozen comments were submitted on this proposed rule. Of those, approximately 10 comments stated concerns about or requested clarifications on at least one issue in the proposed FAR rule. One comment merely requested that the commenting period be extended to permit further comments. (A few other commenters who raised substantive issues also requested more time for additional comments.)

Some of the major issues and concerns raised by the commenters included the following:

Timeframe for Creation and Implementation of Code/Internal Controls System

The current proposal requires companies to have a written code of ethics and conduct within 30 days of award; establish an employee ethics and compliance training program within 90 days of award; and establish an internal control system within 90 days of award. Yet these requirements will apply to contracts with performance periods of as little as 120 days. Accordingly, some commenters questioned the value of these 30- and 90-day requirements being imposed on performance contracts of only 120 days, noting that there will be little overlap.

In addition, one commenter noted that the training and internal controls system requirements lacked specific criteria for implementation. Thus, it would be theoretically possible for a contractor to require training to be conducted once every six months, with internal control reviews to be performed within 12 months of the contract award. Under a short-term contract (anything ranging from the 120-day minimum to nearly six months), it is possible that no training or internal review would occur during the performance period, potentially rendering the proposed rule ineffective.

Additionally, commenters pointed out that an effective code of ethics is not a cookie-cutter document that can simply be cranked out in 30 days. In order to create a useful code, a contractor must first analyze applicable laws, regulations and rules to determine what to include in its code. The entire code-creation process should also include the drafting of the actual language, interaction with the stakeholders to create necessary buy-in, and publication and dissemination of the code. Likewise, the creation and establishment of an internal controls system would likely take more than 90 days. Accordingly, commenters requested larger periods of time in which to implement these proposed requirements, stating that 30 and 90 days simply are not sufficient.

Cooperation With Government

The proposed rule states that an internal control system should include provisions for “timely reporting to appropriate Government officials of any suspected violations of law.” That language, one commenter claims, is too vague and raises further questions, such as:

  • How much and what quality of information would trigger the reporting requirement?
  • At what point during an internal investigation would a contractor have to come forward with the information gathered to that point?
  • Would contractors have to report mere unsubstantiated hearsay or suspicion?

The requirement of “full cooperation” with the government during the course of an investigation also troubled some commenters. That language, commenters noted, could result in pressure on a contractor to waive its attorney-client privilege or to stop paying attorneys’ fees to any employees defending themselves against unproven allegations. One commenter suggested the inclusion of language that would specifically clarify that “full cooperation” does not require the waiver of attorney-client privilege or attorney work-product protections.

Government Hotlines

Requiring contractors to post the hotlines for all federal agencies for which they are working could confuse employees, who may not know which hotline to use. The required posting of agencies’ OIG hotlines also has the potential to undermine the contractor’s own internal controls system. For example, if an employee bypasses a contractor’s internal hotline and just reports evidence of improper conduct to the government, the contractor may be delayed in discovering and analyzing the facts, and in implementing any corrective actions.

The Department of Defense,1 Department of Veterans Affairs2 and Environmental Protection Agency3 currently have regulations requiring contractors to post agency hotlines only when those contractors do not have their own reporting hotlines. One commenter recommended that the FAR adopt this approach in order to eliminate any confusion.

Flowdown Provision

Commenters expressed concern that the flowdown provision – imposing the requirements on subcontractors4 – would have a large impact on small suppliers and contractors. These smaller contractors might be discouraged from performing work for the federal government if they believed the added costs and complications of complying with the proposed rule would exceed the benefits of the work.

Sentencing Guidelines Standards

The rule as currently proposed falls short of the requirements of an effective compliance and ethics program as set forth in the U.S. Sentencing Guidelines for organizations. A problem foreseen by some commenters included smaller contractors creating codes of ethics and internal controls systems in order to comply with the FAR, and then mistakenly believing that this would meet the federal government’s compliance requirements. Some commenters suggested that the FAR requirements should be made identical to those of the Sentencing Guidelines. For example, the FAR should include the Sentencing Guidelines’ requirements of knowledgeable leadership, the exclusion of “bad actors,” and the authority of individuals with day-to-day responsibility for the contractor’s compliance program.

Notice to Contractor

The proposed rule does not currently provide for notice to any contractor that may be in violation of the new requirements. One commenter suggested the addition of language stating that, prior to taking any remedial steps against a contractor, the contracting officer notify the contractor and offer an opportunity to respond.

Ambiguity on Enforcement/Interpretation

The proposed rule does not explain how or when the government would make a determination as to whether a contractor was in compliance with the requirements. In addition, the clause describes what an internal control system should provide. However, it is not clear whether all of those elements are necessary or required. One commenter queried whether such a determination would be within the judgment of the contracting officer. Similarly, it might be possible that a contractor’s code of ethics, training program and internal control system might be deemed to be in compliance by one agency, but not in compliance by another agency.

Additional Concerns

One issue that was not referenced in the comments submitted but which government contractors should be well aware of is the potential for linkage between a contractor’s failure to fully comply with the rule as proposed and the False Claims Act (FCA). For example, if a contractor were to submit a certification that it was in compliance with all applicable FAR requirements but then did not, within 30 or 90 days of award, have all of the required compliance and ethics mechanisms in place, a zealous Department of Justice lawyer (or whistleblower) could conceivably bring a False Claims Act action. Another potential example could involve the application of the FCA in instances where a contractor submits a bill that is in some way inaccurate. The contractor’s failure to comply with the FAR ethics rule could be interpreted as “reckless disregard” of regulatory obligations, and, therefore, a violation of the FCA.


Clearly, there are many valid, significant concerns regarding this proposed addition to the FAR. However, recent trends in government enforcement and compliance and ethics program requirements in other federal and state regulatory schemes suggest that this proposed ethics rule will go forward, in one form or another. Contractors would be prudent, therefore, to begin thinking now – proactively, without waiting until a final rule is promulgated – about their current compliance and ethics infrastructures.

As some of the comments submitted have acknowledged, the Federal Sentencing Guidelines currently set forth carefully delineated elements of an effective compliance and ethics program for all organizations, not just those that contract with the government. It is the Sentencing Guidelines’ requirements that are used by enforcement agencies to evaluate an organization’s compliance and ethics program in the context of most government audits and investigations. Any compliance and ethics program that met the requirements of the Sentencing Guidelines would, in almost every respect meet or exceed the proposed FAR requirements. It would make sense then, that contractors should look to the Sentencing Commission’s compliance guidance to effectively protect themselves and their stakeholders from the vagaries of regulatory investigations and enforcement actions.

1 See DFARS §§ 203.7001(b) & 252.203-7002(c).

2 See 48 C.F.R. §§ 803.7001 & 852.203-71.

3 See 48 C.F.R. §§ 1503.500-72 & 1552.203-71.

4 In its comment, the Associated General Contractors of America noted that the federal government and the construction industry define “subcontract” differently, which could lead to confusion.

Related Insights