1 The Components of a Contractor’s Ethics Program

   The new ethics rules added to the Federal Acquisition Regulation (FAR) in late 2007 (see Appendix A) cover three components of a contractor’s ethics program:

•  A written code of business ethics

•  An internal control system to help contractors and their employees comply with the code

•  An ethics training program (also referred to as an ethics awareness program).

   The changes made in late 2008 (see Appendix B) converted the “suggested” components of an internal control system to “required” components, described in more detail what a company’s ethics training program should involve, and imposed a self-disclosure requirement on contractors.

   A contractor can take two different approaches to implementing these rules:

1. Do only what the FAR requires—do the “shall” but not the “should”

2. Go beyond the “shall” and do the “should”

   This chapter describes the self-disclosure requirements FAR imposes on all contractors as well as the three components of a contractor’s ethics program that apply to some but not all contractors. In doing so, we take the aggressive approach and assume that any contractor would want the benefits of being seen as “a good contractor” (see Preface, p. xiv) in the eyes of a contracting officer and therefore would want to adopt not only those ethics provisions required of the contractor but also those that FAR encourages a contractor to voluntarily adopt, the “shoulds.” Chapter 2 focuses on the applicability of the components of an ethics program to different types and sizes of contracts.

SELF-DISCLOSURE

   The basic rule regarding self-disclosure is this: Generally stated, all contractors and subcontractors face debarment or suspension for failure to disclose illegal contract activities they know about. This general rule has a number of details that have to be mastered but, contrary to the cliché, the devil is not in the details here. The details, according to the FAR Council, are designed to make compliance easier on contractors. Many of these important details are described only in the 30,000 words of the Federal Register publication of the rules, therefore we have included the commentary that accompanies the FAR rules in Appendixes A and B.

   A contractor looking only at the new FAR language will miss many of the important fine points of the FAR provisions. The FAR is only the “letter of the law.” Additional guidance and explanations of the new regulations—the spirit of the law—can be found in the “Responses” accompanying the new regulations in the Federal Register. These responses, prepared by the FAR Council, address comments made by the public on the proposed regulations. They contain important information that is missing from the new rules themselves.

   So in describing these new rules, you will see references to the Federal Register pages featuring the “Responses” for December 2007 rules, which start at 72 FR 65873 (published November 23, 2007), and the December 2008 rules, which start at 73 FR 67064 (published November 12, 2008).

   The starting point of the self-disclosure rules is the text of the FAR clause, FAR 3.1003(a)(2):

   To some extent, this clause makes government contractors and subcontractors responsible for blowing the whistle on illegal conduct in their own contracts—or risk being debarred or suspended if they don’t. But the following five details are critical.

1. The self-disclosure rule applies only to a “principal” in a company. It is not the employees of a company that must report possible wrongdoing. It is only a company “principal,” defined by FAR 2.101 as: “an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager; head of a subsidiary, division, or business segment; and similar positions).” The effect of this “principal principle” is that a company cannot be debarred if an employee knows of illegal conduct on a company contract but fails to report it to top management.

2. The self-disclosure duty applies only if the company principal “knows” about the illegal conduct—not what the principal “should have known.” This “knowing” requirement protects the principal: “[r]equiring a ‘knowledge’ element to the cause of action actually provides more protection for contractors. The Councils do not agree with adding ‘or should have known.’ The principals are only required to disclose what they know.” 73 FR 67069.

3. A principal only has to disclose illegal conduct he or she knows about if there is “credible evidence” of illegal activity. The FAR does not define this critical term, but the FAR Council does give some guidance on what it means in discussing why it changed the operative phrase from “reasonable grounds to believe” to “credible evidence” at the request of the Justice Department:
   
   [Credible evidence] indicates a higher standard, implying that the contractor will have the opportunity to take some time for preliminary examination of the evidence to determine its credibility before [disclosing it] to the Government.… In addition, adding to the standard of “credible evidence” the requirement to make a “timely” report implies that the contractor will have the opportunity to take some time for preliminary examination of the evidence to determine its credibility before deciding to disclose to the Government.… This does not impose upon the contractor an obligation to carry out a complex investigation, but only to take reasonable steps that the contractor considers sufficient to determine that the evidence is credible. 73 FR 67073.

4. A company “principal” does not have to be an expert on the entire U.S. criminal code. The self-disclosure duty applies only to known violations of four federal criminal laws or the civil False Claims Act. The disclosure duty applies to federal criminal laws on fraud, conflicts of interest, bribery and gratuities, but not antitrust violations like bid rigging.
   
   It’s important to make special mention of the conflict of interest laws. Conflicts of interest are prohibited by federal laws, and by federal and agency regulations. The only conflicts of interest subject to the self-disclosure duty are those covered by title 18 of the U.S. Code, the federal criminal code. The FAR Procurement Integrity provisions at 3.104-2(b) are helpful:
   
   Government officers and employees (employees) are prohibited by 18 U.S.C. 208 and 5 CFR Part 2635 from participating personally and substantially in any particular matter that would affect the financial interests of any person with whom the employee is seeking employment. An employee who engages in negotiations or is otherwise seeking employment with an offeror or who has an arrangement concerning future employment with an offeror must comply with the applicable disqualification requirements of 5 CFR 2635.604 and 2635.606. The statutory prohibition in 18 U.S.C. 208 also may require an employee’s disqualification from participation in the acquisition even if the employee’s duties may not be considered ‘participating personally and substantially,’ as this term is defined in 3.104-1.… Post-employment restrictions are covered by 18 U.S.C. 207 and 5 CFR parts 2637 and 2641, that prohibit certain activities by former Government employees, including representation of a contractor before the Government in relation to any contract or other particular matter involving specific parties on which the former employee participated personally and substantially while employed by the Government. Additional restrictions apply to certain senior Government employees and for particular matters under an employee’s official responsibility[.]

5. The self-disclosure duty has, in a sense, a statute of limitations. It starts from the beginning of the solicitation process and lasts until three years after contract closeout. The FAR Councils initially considered using contract closeout as the end point for the requirement to disclose fraud, but:
   
   [A]ccording to the Justice Department, contract fraud often occurs at the time of closeout, and cutting off the obligation to disclose at that point would exempt many of these violations from the obligation to disclose. Three years after final payment is consistent with most of the contractor record retention requirements (see Audit and Records clauses at FAR 52.214-26 and 52.215-2). Therefore, the Councils concur with Justice’s recommendation that the mandatory disclosure of violations should be limited to a period of three years after contract completion, using final payment as the event to mark contract completion. 73 FR 67073.

   It’s important to remember that this duty of self-disclosure that every contractor has is also a required part of a code of business ethics and conduct that only some contractors must have. For example, although a small business does not have to have an internal control system designed to encourage self-disclosure, the small business still has the same self-disclosure duty imposed on all government contractors. Later in this chapter, we will focus more specifically on the FAR requirements for business ethics awareness and the compliance program and internal control system that, as mentioned above, are required only of some contractors but not required of a small business nor all contracts for the acquisition of a commercial item. Before doing so, we will discuss a requirement that, like the duty of self-disclosure, all contractors have: the requirement of adopting a Code of Business Ethics.

A CODE OF BUSINESS ETHICS

   Developing and adopting a code of business ethics is generally not burdensome for a contractor. Codes can be drafted using numerous models found on the Internet (see Appendix C for an example). The code of business ethics developed by the U.S. Department of Transportation Suspension and Debarment Work Group ¹ offers this definition:

   Since these templates are available for contractors to use, drafting a code of business ethics should not be difficult. To summarize, all contractors “should” have a code of business ethics. As we will see in Chapter 2, only some contractors must have a code of business ethics.

   Required Components of a Business Ethics Awareness and Compliance Program and an Internal Control System

   The 2007 FAR requirements in Appendix A for codes of business ethics, training, and internal controls, were a good start for ethics reform, but unfortunately contained a huge landmine: They left contractors thinking that 100 percent compliance provided complete protection if their company somehow got involved in criminal activity. According to the FAR Councils, faithfully following the 2007 FAR requirements created “a false sense of security” in contractors.

   To the FAR Councils, this false sense of security arose from the fact that the 2007 FAR changes failed to alert contractors to the U.S. Sentencing Commission’s guidelines used in sentencing contractors convicted of a felony or Class A misdemeanor, whether or not the crime arose from a procurement situation.

   This defect in the 2007 ethics rules was corrected by the 2008 FAR rules in Appendix B. Now, the FAR’s description of an internal control system satisfies the U.S. Sentencing Commission’s guidelines. In addition, while the 2007 FAR changes provided only vague guidelines for developing an ethics awareness and compliance program and an internal control system, the 2008 FAR changes give a much more detailed and helpful description of them.

   Required Components of a Business Ethics Awareness and Compliance Program

   The FAR now describes this program in 52.203-13(c)(1):

   We will look at each of these in turn.

   Required Components of an Internal Control System

   FAR 52.203-13 (c)(2)(i), adopted as part of the 2008 ethics changes, provides an outline of the internal control system:

   FAR 52.203-13(c)(2)(ii) describes the specific components of an internal control system:

(D) An internal reporting mechanism, such as a hotline, which allows for anonymity or confidentiality, by which employees may report suspected instances of improper conduct, and instructions that encourage employees to make such reports.

(E) Disciplinary action for improper conduct or for failing to take reasonable steps to prevent or detect improper conduct.

(F) Timely disclosure, in writing, to the agency OIG, with a copy to the Contracting Officer, whenever, in connection with the award, performance, or closeout of any Government contract performed by the Contractor or a subcontract thereunder, the Contractor has credible evidence that a principal, employee, agent, or subcontractor of the Contractor has committed a violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 U.S.C. or a violation of the civil False Claims Act (31 U.S.C. 3729-3733).

(G) Full cooperation with any Government agencies responsible for audits, investigations, or corrective actions.

   Notice, as mentioned earlier, that the self-disclosure requirement to avoid a debarment or suspension is also part of a contractor’s code of business ethics and conduct required by FAR 52.203-13.

ETHICS TRAINING PROGRAM

   Of the three components of a contractor ethics program, the training program is the least defined in the FAR. It is not required for small businesses nor for commercial item contracts as we shall see in Chapter 2.

   FAR does not describe what topics must be included in the training. Obviously, the training program would inform employees about the code of business ethics and how to comply with it.

   Although the FAR says little about what such a program should look like, FAR gives some details as to who should receive training:

   That same FAR clause defines two of these terms:

   The training program component is somewhat vague. Although the FAR Councils’ comments in the 2008 changes provide helpful information on other topics, they provide little elaboration on what this training program should look like. One comment to the FAR Councils complained that:

   In its response, the FAR Councils asserted that enough guidance had been given:

   In another response, the FAR Councils stated:

   Bottom line: Companies are on their own in designing the training program that must cover the four criminal laws mentioned above plus the civil False Claims Act. These laws are discussed in detail in Chapters 5 and 6.

NOTE

1. Department of Transportation Suspension and Debarment Work Group. Online at www.fhwa.dot.gov/construction/cqit/ethcguid.cfm (accessed May 2008).