On November 12, 2008, the Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (the Councils) issued a much-anticipated final rule that will require organizations that conduct business with the federal government (for simplicity, hereinafter referred to as contractors) to notify the government whenever they have “credible evidence” of a violation of certain federal criminal laws, a violation of the civil False Claims Act, or the receipt of a government overpayment. In addition, the rule will require many contractors and subcontractors to develop comprehensive ethics awareness and compliance programs and internal control systems to prevent, detect, and eventually report criminal and other improper conduct.1

When the rule takes effect on December 12, 2008, it will significantly expand the compliance obligations for government contractors by: 

  • Subjecting all contractors and subcontractors to potential suspension and debarment from government contracts for a “knowing failure” by a “principal” to “timely disclose” to the government “credible evidence” of (1) a violation of federal criminal law involving fraud, conflict of interest, bribery, or improper gratuity under Title 18 of the U.S. Code, (2) a civil False Claims Act (FCA) violation,2 or (3) a significant overpayment, in connection with the award, performance, or closeout of a government contract. 
  • Imposing a contractual requirement for contracts and subcontracts valued at more than $5 million and with a performance period of at least 120 days (regardless of contract type or place of performance) to disclose to the appropriate agency Office of Inspector General (OIG) whenever the contractor has credible evidence of (1) a violation of federal criminal law involving fraud, conflict of interest, bribery, or improper gratuity under Title 18 of the U.S. Code, or (2) a civil FCA violation, in connection with the award, performance, or closeout of a federal government contract
  • Expanding the ethics awareness and compliance program and internal control systems required for contracts valued at more than $5 million and with a performance period of at least 120 days, except for commercial-item contracts and contracts with small businesses. 
  • Mandating that certain contractors maintain internal control systems that provide for “full cooperation” with government audits and investigations, including providing the identities of the individuals responsible for the conduct and access to “employees with information.”

The rule—which was originally issued as a proposed rule in November 2007, with a subsequent revised proposed rule put forth in May 2008—is the result of a request made by the Department of Justice (DoJ) and implements portions of the “Close the Contractor Fraud Loophole Act,” passed in June 2008.3

Mandatory Disclosure

As the commentary accompanying the final rule indicates, there is “no doubt that mandatory disclosure is a ‘sea change’” for government contractors.4 The shift to mandatory disclosure raises numerous difficult issues concerning how the rule will be interpreted and applied, and how contractors should address the new disclosure requirements. The following highlights some of the more important issues related to the final rule’s mandatory disclosure requirements.

When is the disclosure requirement triggered?

The initial proposed rule would have required timely disclosure whenever the contractor has “reasonable grounds to believe” that a violation of federal criminal law has occurred. The final rule changes and clarifies the proposed disclosure requirement in several important respects.

First, for purposes of suspension and debarment, the new causes for suspension and debarment based on failure to disclose apply when a “principal” of the contractor has knowledge of credible evidence that a violation occurred. The rule defines “principal” as “an officer, director, owner, partner, or a person having primary management or supervisory responsibilities with a business entity.” It provides examples, such as a general manager, plant manager, and head of a subsidiary, division, or business segment. Although the Councils’ commentary indicates that the change is intended to clarify that the knowledge of lower-level employees will not be attributed to the contractor and, standing alone, will not be sufficient to trigger the disclosure obligation, it also suggests that the definition will be interpreted broadly to include compliance officers, directors of internal audit, and “other positions of responsibility.”

The suspension and debarment portion of the rule is further limited in that it applies only to a principal’s “knowing failure” to disclose. The commentary accompanying the final rule indicates that the Councils rejected calls to adopt a “should have known” standard.

Although for suspension/debarment purposes the knowledge must be held by a principal, the contractual obligation to disclose under revised FAR clause 52.203-13 does not express a similar limitation. The rule might be read as creating potential contractual liability for failing to disclose issues known solely by lower-level employees. The basis for that approach would be the desire to force contractors to implement internal controls sufficient to detect misconduct and ensure that appropriate information is reported up to management.

Second, the disclosure requirements apply only when the contractor or a principal of the contractor has “credible evidence” that a violation has occurred. The Councils have indicated that this is a higher standard than the “reasonable grounds to believe” standard used in the proposed rule. The “credible evidence” standard is intended to allow contractors an opportunity to conduct at least a preliminary internal investigation to determine whether a disclosure is necessary.

What must contractors disclose?

Under both the contractual requirements and the suspension and debarment provisions, the disclosure provisions apply to violations of federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations in Title 18 of the U.S. Code and violations of the civil FCA. The suspension and debarment provisions, but not the contractual requirement, also apply to a principal’s knowing failure to disclose “significant overpayment(s) on the contract, other than overpayments resulting from contract financing payments as defined in [FAR] 32.001.”

There are a number of federal statutory provisions in Title 18 that could apply to fraud, including major frauds against the government,5 mail fraud,6 wire fraud,7 and bank fraud.8 Because of the breadth of these statutes, one must pay careful attention to whether the disclosure provisions apply. The statutes relating to bribery of public officials and unlawful gratuities are generally more specific. Any gift given with the intent to influence official acts, or reward past actions, is generally prohibited.9 The federal conflict-of-interest statutes impose lifetime prohibitions on former Executive Branch officers or employees making representational communications with or appearances before government agencies in particular matters involving a specific party or parties, in which they participated personally and substantially while in government, with shorter time periods applying where the participation was of a lesser character.10

The requirement to disclose credible evidence of a civil FCA violation is one of the most troublesome aspects of the new rule. The elements of the FCA, especially as applied to specific factual scenarios, are often interpreted differently by both the courts and by skilled professionals who regularly practice in the area. Moreover, situations that would be handled as contract disputes in the commercial sector are often treated as “fraud” under “implied certification” and other legal theories that are mostly unique to the FCA. In recent years the government has aggressively pursued contractors under the FCA for alleged noncompliance with contractual provisions, including nonconformance with specifications and with contract clauses, such as the Price Reduction and Commercial Sales Practices clauses used in the General Services Administration’s (GSA’s) popular Multiple Award Schedules (MAS) program. The government also has been aggressively pursuing contractors under FCA theories associated with noncompliance with statutory requirements, such as the Trade Agreements Act, and its overly broad interpretation of the Anti-Kickback Act as applied to so-called “alliance benefits.”

Regarding the “significant overpayments” provision, the final rule marks a narrowing from the original proposed rule, which would have required disclosure of any “overpayments.” Although the final rule does not define the meaning of a “significant overpayment,” the commentary accompanying the rule suggests that the requirement is focused on situations in which the government has overpaid on an invoice under one of the contract payment clauses.11 The Councils revised the rule to clarify that contractors are not required to disclose “overpayments” related to contract finance payments, such as advance, progress, interim, and performance-based payments.12 Also, the Councils declined to add a contractual obligation to disclose significant overpayments to FAR clause 52.203-13, concluding that contractors are already obligated to disclose the types of overpayments at issue under the existing contract payment clauses.

Finally, the FAR 52.203-13(b) contractual disclosure requirements are limited to violations connected with the award, performance, or closeout of the particular contract (or contracts) that includes the clause or subcontracts issued under those contracts. For suspension and debarment purposes, however, the disclosure requirements apply in connection with any government contract issued to the contractor or any subcontract issued under those contracts.13

How does the rule apply to violations that pre-date the rule?

Although the final rule applies prospectively in the sense that the suspension and debarment provisions apply starting December 12, 2008, and revised FAR clause 52.203-13 applies when incorporated into new and existing contracts, the commentary accompanying the rule indicates that for suspension and debarment purposes the disclosure provisions apply to conduct that pre-dates the rule’s effective date. Accordingly, although the suspension and debarment provisions take effect December 12, 2008, the obligation to disclose may reach back to incidents that took place prior to the rule. However, the rule limits the reach of the suspension and debarment disclosure provisions to three years after final payment is received on the government contract.

When must a violation be disclosed?

The final rule requires “timely” disclosure, but it does not establish a firm deadline by which a contractor must come forward. This is another area where there are some nuanced differences between the contractual standard and that applicable for suspension and debarment purposes. Under the contractual clause set out at FAR 52.203-13, timeliness is measured from the date a principal of the contractor first knew there was credible evidence of a violation, the date the clause was incorporated into the contract, or the date the required internal control system was established, whichever date is later. For suspension and debarment purposes, however, timely disclosure is measured from the date the contractor identified credible evidence or the effective date of the rule, whichever is later. Therefore, the timeliness of violations previously known to the contractor is measured from December 12, 2008, for suspension and debarment purposes, but from the date the contractor becomes subject to the new version of FAR 52.203-13 and implements the internal controls with respect to the contractual duty to disclose. Accordingly, contractors who have credible evidence of a past violation related to a contract that was not closed out before December 12, 2005, will want to make a quick decision on whether to disclose the incident to the government.

To whom is the disclosure made?

For purposes of suspension and debarment, the rule simply provides for disclosure to the government. Under the contractual mandatory disclosure and internal control system requirements, the contractor must make the disclosure to the appropriate agency OIG and provide a copy to the contracting officer. For contract vehicles that involve multiple agencies, such as GSA’s MAS program, the contractor must provide notice to the OIG of the ordering agency and the OIG of the contracting agency. The requirement that the disclosure be made to the OIG is significant. While a government contracting officer typically would be more inclined to handle incidents that may be borderline FCA issues under the terms of the contract, the OIG is more likely to view the disclosure through the lens of a fraud investigation and potential FCA action against the contractor.

Will a knowing failure to disclose by the principal necessitate debarment or suspension?

No. The fact that a failure to disclose is a cause for suspension or debarment does not necessarily mean that the contractor will be suspended or debarred. Under the FAR, the suspension and debarment official will review the circumstances, including the list of potential mitigating factors located at FAR 9.406-1, to determine whether the contractor is a presently responsible business partner and whether suspension or debarment is necessary to protect the government’s interest. As a practical matter, however, the expansion of the causes for suspension or debarment to include a knowing failure to disclose substantially increases the risk of suspension or debarment.

Business Ethics Awareness and Compliance Program and Internal Control System

The final rule also expands the business ethics and awareness program and internal control system requirements under FAR clause 52.203-13(c). These requirements apply unless the contract is for a commercial item or the contractor represents itself as a small business. The rule requires that the business ethics awareness program include periodic communication of the contractor’s standards and ethics programs, “effective” training programs for principals and employees, and dissemination of ethics and compliance guidance to all levels of the organization. The training also must be provided to agents and subcontractors, “as appropriate.”

Additionally, the final rule sets forth a number of mandatory internal controls that are patterned after the U.S. Sentencing Guidelines guidance for organizational compliance and ethics programs. The requirement to discover and disclose certain violations is only one aspect of the internal control system. A contractor will also be responsible for taking reasonable efforts to exclude unethical individuals from decision-making positions. It also must conduct periodic reviews of business practices, procedures, policies, and internal controls and periodic assessments of the risk of criminal conduct.

Finally, although the “internal control” requirements are not imposed as contractual requirements on commercial companies and small businesses, the practical effect of the rule will push all contractors to consider implementing a robust internal control system in order to detect and report where there is credible evidence of a violation of the civil False Claims Act, significant overpayments, or criminal violations involving fraud, conflict of interest, bribery, or gratuities.

Full Cooperation

Under revised FAR 52.203-13(c) (not applicable to commercial item contracts or where the contractor represents itself as a small business), a contractor’s internal control system must provide for “full cooperation” with government agencies responsible for audits, investigations, and corrective action. In response to critical comments directed at the “full cooperation” requirement in the proposed rule, the Councils attempted to clarify what constitutes “full cooperation” and how that obligation relates to the rights of the contractor and its employees.

“Full cooperation” is defined as “disclosure to the Government of the information sufficient for law enforcement to identify the nature and extent of the offense and the individuals responsible for the conduct. It includes providing timely and complete response to Government auditors’ and investigators’ request for documents and access to employees with information.” The definition goes on to state, however, that contractors are not precluded from asserting their legal rights. Specifically, full cooperation does not require the contractor to waive its attorney-client privilege or the work-product doctrine, and it does not require individuals (including the owner of a contractor that is a sole proprietorship) to waive either their attorney-client privilege or their Fifth Amendment rights.

Notwithstanding these qualifications on the meaning of full cooperation, there is substantial concern that the final rule will harm the ability of counsel to advise his or her clients. Specifically, a requirement to disclose the names of individuals involved in the conduct and to make witnesses available to government investigators and auditors may have a chilling effect on a witness’s willingness to seek legal assistance with respect to a potential violation and on a counsel’s ability to acquire from witnesses the facts necessary to enable counsel to serve his or her client. As stated by the Supreme Court in the seminal case of Upjohn Co. v. United States, 449 U.S. 383, 390-91:

“A lawyer should be fully informed of all the facts of the matter he is handling in order for his client to obtain the full advantage of our legal system. It is for the lawyer in the exercise of his independent professional judgment to separate the relevant and important from the irrelevant and unimportant. The observance of the ethical obligation of a lawyer to hold inviolate the confidences and secrets of his client not only facilitates the full development of facts essential to proper representation of the client but also encourages laymen to seek early legal assistance.”

(quoting ABA Code of Professional Responsibility, Ethical Consideration 4-1). The new rule runs counter to this basic tenet of the attorney-client relationship.

Government Protection of Information Disclosed Under New Rule

There is also the issue of what happens to the information concerning potential violations or “credible evidence” after it is disclosed to the government. The final rule adds a statement in FAR 52.203-13 that the government will not automatically make any disclosed information public. However, the rule only states that it will protect information that is marked “confidential” or “proprietary” “to the extent permitted by law or regulation” and that a contractor will be notified prior to release of the information under the Freedom of Information Act. Therefore, the rule provides no guaranty that information disclosed will be protected from public disclosure.


The final rule requires prime contractors subject to FAR 52.203-13 to “flow down” the clause to subcontracts valued at more than $5 million and with terms of 120 days or more. Subcontractors are instructed to direct any required disclosure to the appropriate OIG(s), not the prime contractor.

Implications and Best Practices

The final rule will have far reaching implications and necessitate significant changes in how most contractors approach compliance with government contracts-related requirements. As part of these changes, contractors may want to consider the following points.

In anticipation of the December 12, 2008, effective date, contractors should consider conducting a “sweep” of all internal reports of government contract-related incidents within the past several years and assess whether a disclosure should now be made in light of the new suspension and debarment rules. In instances of “close calls,” contractors should further consider documenting any determination that disclosure is unnecessary (e.g., for lack of credible evidence of a violation).

Most contractors will find it necessary to implement significant revisions to their compliance programs and internal control systems. Contactors that are not subject to the FAR 52.203-13(c) ethics awareness and compliance program and internal control systems requirements (contractors that are small businesses or that only have commercial item contracts or contracts valued at less than $5 million) should nonetheless consider bolstering their compliance programs, especially including employee awareness and internal reporting mechanisms, to account for the mandatory disclosure requirements. This is especially so considering the potentially drastic consequences of suspension or debarment from government contracting. Notably, suspension or debarment from federal contracting may also impact the contractor’s ability to sell to certain state governments. A number of state procurement systems are tied to the federal system for suspending or debarring contractors.

As to investigating internal reports of potential misconduct, attorneys conducting the investigation need to be cognizant of the applicability of the “full cooperation” provisions set out in FAR 52.203-13(c). As indicated above, full cooperation includes providing auditors and investigators with certain factual information, including the identities of the individuals involved in the misconduct and “access to employees with information.” In addition to issues relating to waiver of the attorneyclient privilege and attorney work product protections, attorneys should carefully weigh issues associated with “corporate Miranda” warnings, the potential provision of separate counsel, and potential privacy-related provisions included in corporate labor agreements and the laws of the applicable jurisdiction.

Contractors that make required disclosures should be prepared for the possible consequences. Contractors should be mindful that the disclosure alone does not preclude the government or a third-party qui tam relator (sometimes in the form of a disgruntled employee or ex-employee) from suing the contractor based on the same or similar information. Furthermore, contractors should consider potential implications with respect to the securities laws and Sarbanes-Oxley. The contractor should also consider whether it would be prudent to take the proactive step of meeting with the appropriate suspension and debarment official(s) to demonstrate that the contractor is appropriately handling the situation and is otherwise a presently responsible contractor, such that neither suspension nor debarment would be necessary to protect the government’s interests. Depending on the nature of the disclosed incident, the contractor may need to prepare to defend against a possible termination of the contract for default and/or potentially an attempt by the government to claim the contract is unenforceable. 14

Contractors should also bear in mind that the final rule may somewhat alter relationships with subcontractors and teaming partners. Contractors should consider whether confidentiality agreements with teaming partners will need to be revised in order to address the FAR’s new disclosure requirements. Contractors will also need to ensure that FAR clause 52.203-13 is flowed down to subcontractors as required. Also, in response to the rule’s requirement that a contractor’s training program include agents and subcontractors, “as appropriate,” contractors should consider the extent to which their compliance programs will entail offering training to subcontractors and/or verifying that a subcontractor has sufficient compliance systems in place.

Finally, for contractors contemplating a merger or acquisition, the new rule heightens the need to take steps to ensure that the company is not blind-sided by a situation where the target company has an undisclosed government contract-related violation. The new suspension and debarment provisions significantly increase the risks associated with failures to identify undisclosed violations.