In the National Defense Authorization Act for Fiscal Year 2008, Pub. L. No. 110-181, § 848, Congress tasked the Government Accountability Office (GAO) with reporting on the ethics and compliance programs of major defense contractors, defined as those that had received more than $500 million in Department of Defense (DoD) contracts in fiscal year 2006. On September 22, 2009, the GAO released its report entitled "Defense Contracting Integrity: Opportunities Exist to Improve DoD's Oversight of Contractor Ethics Programs," GAO Report No. GAO-09-591.
GAO found that most of the large contractors it studied had a range of ethics programs in place even before the amendments to the Federal Acquisition Regulation (FAR) in 2007 and 2008, see 72 Fed. Reg 65873 (Nov. 23, 2007); 73 Fed Reg. 67604 (Nov. 12, 2008), became final and mandated such programs. For example, most contractors had codes of business conduct, established ethics and compliance programs, internal control systems with high-level management oversight, internal review or auditing practices, anonymous internal reporting mechanisms and disciplinary processes in place. More than half also had policies for voluntary disclosure of DoD contract-related violations or misconduct.
GAO noted that DoD had made two improvements to its oversight of contractors in response to the new FAR internal ethics and compliance program rules, but could make improvements in two other areas. In the "improvements" column, GAO noted that the DCAA updated its audit guidance to include guidelines for audits of controls of contractor integrity and compliance programs (although as also reported in this newsletter that guidance creates significant concerns for contractors). Second, the DoD Inspector General (DoD IG) replaced its voluntary disclosure program with a Contractor Disclosure Program that provides a web-based means of making disclosures required by the FAR rules and centralizes and coordinates review of such disclosures, among other things.
In the "needs improvement" column, GAO commented that DoD has not yet assigned responsibility for verifying implementation of contractor ethics programs during program performance. In addition, GAO noted that because the FAR rules do not require contractors to post DoD IG fraud hotline reporting posters if the contractor has its own internal hotlines and posters, DoD itself might receive fewer reports of suspected misconduct. Moreover, GAO expressed concern that employees reporting suspected misconduct internally may not receive the same whistleblower protections.
To address these perceived gaps, GAO recommended four actions:
- The Secretary of Defense should direct the Under secretary of Defense for Acquisition, Technology and Logistics (AT&L) to determine if new DFARS or other guidance is necessary to clarify functional responsibility of the Defense Contract Management Agency or other contracting officials for verifying during contract performance implementation of the required contractor ethics and compliance program.
- The DoD IG should determine the need for defense contractors to display the DoD IG's fraud hotline posters.
- The DoD IG should determine the contents of its fraud hotline posters, including revisions to advise employees of their protections under whistleblower laws.
- If the DoD IG determines that its fraud hotline posters should be displayed, the Under Secretary of Defense for AT&L should propose revisions to the DFARS to include a contract clause requiring contractors to display the DoD IG hotline posters, regardless of whether the contractor has its own hotline.
Overall, the GAO's report shows that most major DoD contractors have implemented internal ethics and compliance programs, and with the new FAR requirements in place, additional measures needed to shore up those programs are relatively minor.