On November 23, 2007, the Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (Councils) issued a final rule effective on Christmas Eve, December 24, 2007, amending the FAR to address requirements for a contractor code of business ethics and conduct as well as requirements for display of agency Office of the Inspector General (OIG) Fraud Hotline posters. See 72 Fed. Reg. 65873 (Nov. 23, 2007).

(As reported in our March 2007 update, the initially proposed rule required contractors receiving awards in excess of $5 million to within 30 days of contract award, to have a written code of ethics and business conduct in place; and, within 90 days of contract award, have in place an employee ethics and compliance training program and an internal control system to promote compliance with the code of ethics and business conduct. (See www.wileyrein.com/FAR_rulechange.) The final rule is not the last word on requirements relating to contractor ethics and business conduct, as the Councils also proposed additional requirements in areas they decided warranted more public comment and consideration. 72 Fed. Reg. 64019 (Nov. 14, 2007).

Final Rule in FAR Case 2006-007

The most significant changes to the initially proposed rule reflected in the Councils' final rule are the following:

  • The requirement for a formal training program and internal control system has been made inapplicable to small businesses; however, small businesses are still required to have a business code of ethics and distribute the code to their employees;
  • Contracting officers have been given authority to increase the 30-day time period for preparation of a code of business ethics and conduct and the 90-day time period for establishment of an ethics awareness and compliance program and internal control system, upon request of the contractor;
  • The requirements in the internal control system relating to ''disclosure'' and ''full cooperation'' have been deleted; proposed rules relating to these issues have been moved to FAR Case 2007-006 for further consideration;
  • Clause 52.203-XX has been separated into two clauses—one to address the contractor code of business ethics and conduct, and one to address the requirements for hotline posters; and
  • A contractor is not required to display Government fraud hotline posters (other than any required Department of Homeland Security (DHS) posters) if it has established a mechanism by which employees may report suspected instances of improper conduct, and instructions that encourage employees to make such reports. This change aligns the posting requirement with DFARS 252.203-7002, but the rule still potentially subjects contractors to multiple posting requirements if they do not have an established mechanism by which employees can report instances of suspected misconduct. Furthermore, Clause 52.203-14(c) still requires posting of DHS posters if the contract is funded by disaster assistance funding, and DHS requests the posting of a fraud hotline poster applicable to the specific contract.

The Councils rejected claims that the ethics and business conduct rules were duplicative of existing requirements, noting that current DFARS requirements are not mandatory and that requirements for ethics programs under the Sarbanes-Oxley Act apply only to accounting firms and publicly traded companies. The Councils expressed their view that the final rule is "broad and flexible, capturing the common essence of good ethics and standards of conduct." Although some commenting parties believed more specific guidelines should be adopted or industry "best practices" explored, the Councils declined to adopt more specific guidelines and noted that FAR Case 2007-006 will propose a set of mandatory requirements for internal control systems.

The Councils also declined to make several requested changes to the rules. For example, the Councils declined to align the FAR rule with requirements in the U.S. Sentencing Guidelines; they noted, however, that this issue would be re-addressed in FAR Case 2007-006. The Councils also declined to revise or further clarify the definition of contracts that would be covered by the new rule (i.e., those with a value over $5 million and a period of performance of 120 days or more). The Councils determined that the $5 million threshold is appropriate because it is consistent with the Department of Defense (DoD) threshold for contractor ethics requirements. They retained the 120-day performance period, despite comments that it was too short, because, among other reasons, contracts responding to emergency situations are often of short duration and "are the very type of contract that needs to be covered."

The Councils further rejected a request to make the rules apply on a pre-award basis, finding that FAR 9.104-1(d) already requires the Government to contract with contractors who have a satisfactory record of business ethics and integrity and that a pre-award requirement would impede new contract awards. The Councils also declined to make the FAR rule discretionary like the DFARS. The Councils reasoned that a discretionary rule is no longer strong enough in light of the trend to increase contractor compliance with ethical rules of business conduct. The Councils retained the exception for commercial item contracts under FAR Part 12 and for contracts performed entirely outside the United States, but did not adopt an additional requested exception for research and development contracts issued to universities or other non-profit entities.

The Councils also clarified certain ambiguous areas. For example, some contractors questioned how the Government would verify compliance with the new rules. The Notice explains that Contracting Officers are not required to verify compliance, but may, in their discretion, inquire as to compliance, and compliance would be incorporated into normal contract administration. According to the Notice, "[t]he contracting officer does not judge the internal control system, but only verifies its existence." The Notice also states that unless there are compliance concerns, the Government generally will not require the submission of compliance plans to the Government or include the code of ethics as a contract deliverable. With regard to flowdown of the requirements to subcontractors, some commenting parties expressed confusion as to whether the flowdown requirements apply only to formal "subcontracts" or also apply to purchase orders. The Notice states that the intent of the rule is that it apply to all subcontracts, including purchase orders. Also regarding flowdown obligations, some commenting parties questioned whether prime contractors would be required to monitor or oversee subcontractor compliance programs. The Notice clarifies that the prime contractor "is not required to judge or monitor the ethics awareness program and internal control systems of the subcontractors—just check for existence." Subcontractor disclosure requirements will also be addressed in FAR Case 2007-006.

Proposed Rule in FAR Case 2007-006

Shortly before the release of the final rule in FAR Case 2006-007, the Councils issued additional proposed rules relating to contractor codes of ethics and business conduct. These additional requirements, proposed at the request of the Department of Justice (DoJ), would "require contractors to have a code of ethics and business conduct, establish and maintain specific internal controls to detect and prevent improper conduct in connection with the award or performance of Government contracts or subcontracts, and to notify contracting officers without delay whenever they become aware of violations of Federal criminal law with regard to Government contracts or subcontracts." FAR Case 2007-006, 72 Fed. Reg. 64019 (Nov. 14, 2007). The proposed rule also incorporates concepts recommended by a DoJ Procurement Fraud Task Force "white paper" that suggested further internal controls be imposed on contractors. (See www.wileyrein.com/reform_proposals.) The most important new requirements under consideration in FAR Case 2007-006 are discussed below.

Compliance Programs. The proposed rule in FAR Case 2007-006 would require a contractor to maintain an internal compliance program as part of its contractor's obligation to have "a satisfactory record of integrity and business ethics." That record would become a general standard of a contractor's responsibility under FAR 9.104-1, and be evaluated as part of the contractor's past performance evaluation during a source selection.

U.S. Sentencing Guidelines. The Councils propose to modify the clause recently adopted in FAR Case 2006-007 to more closely match the U.S. Sentencing Commission Guidelines Manual, Section 8B2.1. The Sentencing Guidelines provide guidance on what the U.S. Sentencing Commission considers an effective ethics and compliance programs for entities convicted of a felony or Class A misdemeanor.

Affirmative Reporting Obligations. The proposed rule in FAR Case 2007-006 would impose an affirmative reporting obligation on contractors to disclose in a timely manner a violation of federal criminal law in connection with the award or performance of any government contract or subcontract. This reporting obligation would be required of both large and small businesses, and the penalty for a "knowing" failure to timely disclose criminal acts would be potential suspension and debarment. The Councils further propose mandating that contractor internal control systems include a requirement to report violations of federal criminal law. According to DoJ, this mandatory disclosure requirement is necessary because voluntary reporting under provisions established for DoD contractors has been inadequate. The Councils specifically requested comments regarding "any appropriate limitation on the reporting requirement," suggesting that the final rule may include limitations that DoJ has not yet proposed.

Suspension and Debarment. As requested by DoJ, the Councils propose modification of FAR 9.406-2 and 9.407-2 to include a new cause for debarment or suspension: a knowing failure to timely disclose an overpayment on a government contract or violation of federal criminal law in connection with the award or performance of any government contract performed by the contractor or any subcontract.

Full Cooperation. The proposed rule also includes a requirement that a contractor's mandatory internal compliance program provide for "full cooperation with any Government agencies responsible for audit, investigation, or corrective action." This requirement was derived from guidance in DFARS 203.7001(a)(7), with the addition of "audits." Although a similar rule had been proposed in FAR Case 2006-007, the Councils declined to address this requirement in that FAR Case and deferred it to FAR Case 2007-006 so as to allow for additional public comment and analysis of the implication of such a rule on waiver of the attorney-client privilege.

Commercial Item Exception. Consistent with the final rule in FAR Case 2006-007, FAR Case 2007-006 would exclude commercial item contracts. The DoJ "white paper" had suggested that compliance program requirements should extend to commercial item contracts, but the Councils do not recommend such an approach. According to the Notice accompanying the proposed rule, "[r]equiring commercial contractors to comply with the rule would not be consistent with Public Law 103-355 that requires the acquisition of commercial items to resemble customarily commercial marketplace practices to the maximum extent practicable."

The proposed rule change signals a continuing shift toward greater regulation and oversight of the government contracting community. Most established contractors already have compliance programs in place. However, the proposed rule in FAR Case 2007-006, if adopted as proposed, will impose certain mandatory requirements that contractors will need to incorporate into their compliance programs. The affirmative reporting obligations (which apply to small and large businesses alike) and attendant threat of suspension and debarment for disclosure failures are significant additional requirements that reinforce the need for sound, effective internal compliance programs that adequately prevent and detect violations of federal procurement laws.

The final rule in FAR Case 2006-007 will go into effect December 24, 2007. Comments on the additional requirements proposed in FAR Case 2007-006 are due January 14, 2008. The bottom line is that contractors should review their current codes of ethics, standards of conduct, internal controls and reporting policies to ensure they are in compliance with the changing requirements.