Elevating the Role of the Business Analyst
Publication date: 12/01/2007
Federal Procurement Ethics: The Complete Legal Guide
About the Author
Terrence M. O’Connor is Special Counsel to the law firm of Albo & Oblon, L.L.P. in Arlington VA for government contract issues. A graduate of Notre Dame Law School, he served as a government attorney from 1971 to 1985. He then went into private practice advising government contractors and litigating government contract cases before the various Boards of Contract Appeals, the Government Accountability Office, the U.S. Court of Federal Claims, and the U.S. Court of Appeals for the Federal Circuit. In 1985, he also began teaching government contract courses for Management Concepts, which continue to today. In 1991, he received his Master of Laws (Government Procurement Law) degree from the George Washington University Law Center.
For more than 25 years, he has written the “Recent Decisions” column for the Federal Acquisition Report. He has also authored several books published by Management Concepts, including Understanding Government Contract Law and Federal Contracting Answer Book.
The new ethics rules added to the Federal Acquisition Regulation (FAR) in late 2007 (see Appendix A) cover three components of a contractor’s ethics program:
A written code of business ethics
An internal control system to help contractors and their employees comply with the code
An ethics training program (also referred to as an ethics awareness program).
The changes made in late 2008 (see Appendix B) converted the “suggested” components of an internal control system to “required” components, described in more detail what a company’s ethics training program should involve, and imposed a self-disclosure requirement on contractors.
A contractor can take two different approaches to implementing these rules:
Do only what the FAR requires—do the “shall” but not the “should”
Go beyond the “shall” and do the “should”
This chapter describes the self-disclosure requirements FAR imposes on all contractors as well as the three components of a contractor’s ethics program that apply to some but not all contractors. In doing so, we take the aggressive approach and assume that any contractor would want the benefits of being seen as “a good contractor” (see Preface, p. xiv) in the eyes of a contracting officer and therefore would want to adopt not only those ethics provisions required of the contractor but also those that FAR encourages a contractor to voluntarily adopt, the “shoulds.” Chapter 2 focuses on the applicability of the components of an ethics program to different types and sizes of contracts.
The basic rule regarding self-disclosure is this: Generally stated, all contractors and subcontractors face debarment or suspension for failure to disclose illegal contract activities they know about. This general rule has a number of details that have to be mastered but, contrary to the cliché, the devil is not in the details here. The details, according to the FAR Council, are designed to make compliance easier on contractors. Many of these important details are described only in the 30,000 words of the Federal Register publication of the rules, therefore we have included the commentary that accompanies the FAR rules in Appendixes A and B.
A contractor looking only at the new FAR language will miss many of the important fine points of the FAR provisions. The FAR is only the “letter of the law.” Additional guidance and explanations of the new regulations—the spirit of the law—can be found in the “Responses” accompanying the new regulations in the Federal Register. These responses, prepared by the FAR Council, address comments made by the public on the proposed regulations. They contain important information that is missing from the new rules themselves.
So in describing these new rules, you will see references to the Federal Register pages featuring the “Responses” for December 2007 rules, which start at 72 FR 65873 (published November 23, 2007), and the December 2008 rules, which start at 73 FR 67064 (published November 12, 2008).
The starting point of the self-disclosure rules is the text of the FAR clause, FAR 3.1003(a)(2):
[A] contractor may be suspended and/or debarred for knowing failure by a principal to timely disclose to the Government, in connection with the award, performance, or closeout of a Government contract performed by the contractor or a subcontract awarded thereunder, credible evidence of a violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code or a violation of the civil False Claims Act. Knowing failure to timely disclose credible evidence of any of the above violations remains a cause for suspension and/or debarment until 3 years after final payment on a contract (see 9.406-2(b)(1)(vi) and 9.407-2(a)(8)).
To some extent, this clause makes government contractors and subcontractors responsible for blowing the whistle on illegal conduct in their own contracts—or risk being debarred or suspended if they don’t. But the following five details are critical.
The self-disclosure rule applies only to a “principal” in a company. It is not the employees of a company that must report possible wrongdoing. It is only a company “principal,” defined by FAR 2.101 as: “an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager; head of a subsidiary, division, or business segment; and similar positions).” The effect of this “principal principle” is that a company cannot be debarred if an employee knows of illegal conduct on a company contract but fails to report it to top management.
The self-disclosure duty applies only if the company principal “knows” about the illegal conduct—not what the principal “should have known.” This “knowing” requirement protects the principal: “[r]equiring a ‘knowledge’ element to the cause of action actually provides more protection for contractors. The Councils do not agree with adding ‘or should have known.’ The principals are only required to disclose what they know.” 73 FR 67069.
A principal only has to disclose illegal conduct he or she knows about if there is “credible evidence” of illegal activity. The FAR does not define this critical term, but the FAR Council does give some guidance on what it means in discussing why it changed the operative phrase from “reasonable grounds to believe” to “credible evidence” at the request of the Justice Department:
[Credible evidence] indicates a higher standard, implying that the contractor will have the opportunity to take some time for preliminary examination of the evidence to determine its credibility before [disclosing it] to the Government.… In addition, adding to the standard of “credible evidence” the requirement to make a “timely” report implies that the contractor will have the opportunity to take some time for preliminary examination of the evidence to determine its credibility before deciding to disclose to the Government.… This does not impose upon the contractor an obligation to carry out a complex investigation, but only to take reasonable steps that the contractor considers sufficient to determine that the evidence is credible. 73 FR 67073.
A company “principal” does not have to be an expert on the entire U.S. criminal code. The self-disclosure duty applies only to known violations of four federal criminal laws or the civil False Claims Act. The disclosure duty applies to federal criminal laws on fraud, conflicts of interest, bribery and gratuities, but not antitrust violations like bid rigging.
It’s important to make special mention of the conflict of interest laws. Conflicts of interest are prohibited by federal laws, and by federal and agency regulations. The only conflicts of interest subject to the self-disclosure duty are those covered by title 18 of the U.S. Code, the federal criminal code. The FAR Procurement Integrity provisions at 3.104-2(b) are helpful:
Government officers and employees (employees) are prohibited by 18 U.S.C. 208 and 5 CFR Part 2635 from participating personally and substantially in any particular matter that would affect the financial interests of any person with whom the employee is seeking employment. An employee who engages in negotiations or is otherwise seeking employment with an offeror or who has an arrangement concerning future employment with an offeror must comply with the applicable disqualification requirements of 5 CFR 2635.604 and 2635.606. The statutory prohibition in 18 U.S.C. 208 also may require an employee’s disqualification from participation in the acquisition even if the employee’s duties may not be considered ‘participating personally and substantially,’ as this term is defined in 3.104-1.… Post-employment restrictions are covered by 18 U.S.C. 207 and 5 CFR parts 2637 and 2641, that prohibit certain activities by former Government employees, including representation of a contractor before the Government in relation to any contract or other particular matter involving specific parties on which the former employee participated personally and substantially while employed by the Government. Additional restrictions apply to certain senior Government employees and for particular matters under an employee’s official responsibility[.]
The self-disclosure duty has, in a sense, a statute of limitations. It starts from the beginning of the solicitation process and lasts until three years after contract closeout. The FAR Councils initially considered using contract closeout as the end point for the requirement to disclose fraud, but:
[A]ccording to the Justice Department, contract fraud often occurs at the time of closeout, and cutting off the obligation to disclose at that point would exempt many of these violations from the obligation to disclose. Three years after final payment is consistent with most of the contractor record retention requirements (see Audit and Records clauses at FAR 52.214-26 and 52.215-2). Therefore, the Councils concur with Justice’s recommendation that the mandatory disclosure of violations should be limited to a period of three years after contract completion, using final payment as the event to mark contract completion. 73 FR 67073.
It’s important to remember that this duty of self-disclosure that every contractor has is also a required part of a code of business ethics and conduct that only some contractors must have. For example, although a small business does not have to have an internal control system designed to encourage self-disclosure, the small business still has the same self-disclosure duty imposed on all government contractors. Later in this chapter, we will focus more specifically on the FAR requirements for business ethics awareness and the compliance program and internal control system that, as mentioned above, are required only of some contractors but not required of a small business nor all contracts for the acquisition of a commercial item. Before doing so, we will discuss a requirement that, like the duty of self-disclosure, all contractors have: the requirement of adopting a Code of Business Ethics.
A CODE OF BUSINESS ETHICS
Developing and adopting a code of business ethics is generally not burdensome for a contractor. Codes can be drafted using numerous models found on the Internet (see Appendix C for an example). The code of business ethics developed by the U.S. Department of Transportation Suspension and Debarment Work Group 1 offers this definition:
A Code of Business Ethics is an open disclosure of the way an organization operates and provides visible guidelines for behavior. It serves as an important communication vehicle to the company’s employees, customers, subcontractors, and the community at large that the organization is committed to the highest ethical standards of conduct in its operations.
Additionally, a Code of Business Ethics is intended to promote ethical and law-abiding conduct within an organization and clearly communicate to employees what is expected of them and the consequences for violations.
The following are a few of the elements an effective Code of Business Ethics should have:
Commitment by the organization’s directors and top management to abiding by the Code and also ensuring that all employees are aware of and abide by the Code
Applicability to all levels of the organization
A letter from the President or Chief Executive of the organization communicating what the Code is and the organization’s commitment to following the Code
A table of contents so that employees will be able to easily find the organization’s policy for a specific issue
A statement of policy concerning the Code and the general rules that apply to the Code
Standards of Conduct that communicate what issues employees should be aware of and what to do whenever confronted with any such issue
A statement requiring employees to report suspected violations and to cooperate with the implementation of the code.
Since these templates are available for contractors to use, drafting a code of business ethics should not be difficult. To summarize, all contractors “should” have a code of business ethics. As we will see in Chapter 2, only some contractors must have a code of business ethics.
Required Components of a Business Ethics Awareness and Compliance Program and an Internal Control System
The 2007 FAR requirements in Appendix A for codes of business ethics, training, and internal controls, were a good start for ethics reform, but unfortunately contained a huge landmine: They left contractors thinking that 100 percent compliance provided complete protection if their company somehow got involved in criminal activity. According to the FAR Councils, faithfully following the 2007 FAR requirements created “a false sense of security” in contractors.
Businesses (especially small businesses) may believe they have met all the compliance requirements of the U.S. Government by following the FAR; this will create a false sense of security. 72 FR 64020.
To the FAR Councils, this false sense of security arose from the fact that the 2007 FAR changes failed to alert contractors to the U.S. Sentencing Commission’s guidelines used in sentencing contractors convicted of a felony or Class A misdemeanor, whether or not the crime arose from a procurement situation.
The U.S. Sentencing Guidelines provide guidance on what the U.S. Sentencing Commission expects in the way of an effective compliance and ethics program from organizations convicted of a felony or Class A misdemeanor. The Department of Justice and other respondents to the FAR Case 2006–007 proposed rule [now adopted] considered that that proposed rule left out important elements that are covered in the U.S. Sentencing Guidelines and that this can create confusion. 72 FR 94019-20.
This defect in the 2007 ethics rules was corrected by the 2008 FAR rules in Appendix B. Now, the FAR’s description of an internal control system satisfies the U.S. Sentencing Commission’s guidelines. In addition, while the 2007 FAR changes provided only vague guidelines for developing an ethics awareness and compliance program and an internal control system, the 2008 FAR changes give a much more detailed and helpful description of them.
Required Components of a Business Ethics Awareness and Compliance Program
The FAR now describes this program in 52.203-13(c)(1):
(i) This program shall include reasonable steps to communicate periodically and in a practical manner the Contractor’s standards and procedures and other aspects of the Contractor’s business ethics awareness and compliance program and internal control system, by conducting effective training programs and otherwise disseminating information appropriate to an individual’s respective roles and responsibilities.
We will look at each of these in turn.
Required Components of an Internal Control System
FAR 52.203-13 (c)(2)(i), adopted as part of the 2008 ethics changes, provides an outline of the internal control system:
(i) The Contractor’s internal control system shall—
(A) Establish standards and procedures to facilitate timely discovery of improper conduct in connection with Government contracts; and
(B) Ensure corrective measures are promptly instituted and carried out.
FAR 52.203-13(c)(2)(ii) describes the specific components of an internal control system:
At a minimum, the Contractor’s internal control system shall provide for the following:
(A) Assignment of responsibility at a sufficiently high level and adequate resources to ensure effectiveness of the business ethics awareness and compliance program and internal control system.
(B) Reasonable efforts not to include an individual as a principal, whom due diligence would have exposed as having engaged in conduct that is in conflict with the Contractor’s code of business ethics and conduct.
(C) Periodic reviews of company business practices, procedures, policies, and internal controls for compliance with the Contractor’s code of business ethics and conduct and the special requirements of Government contracting, including—
1) Monitoring and auditing to detect criminal conduct;
2) Periodic evaluation of the effectiveness of the business ethics awareness and compliance program and internal control system, especially if criminal conduct has been detected; and
3) Periodic assessment of the risk of criminal conduct, with appropriate steps to design, implement, or modify the business ethics awareness and compliance program and the internal control system as necessary to reduce the risk of criminal conduct identified through this process.
(D) An internal reporting mechanism, such as a hotline, which allows for anonymity or confidentiality, by which employees may report suspected instances of improper conduct, and instructions that encourage employees to make such reports.
(E) Disciplinary action for improper conduct or for failing to take reasonable steps to prevent or detect improper conduct.
(F) Timely disclosure, in writing, to the agency OIG, with a copy to the Contracting Officer, whenever, in connection with the award, performance, or closeout of any Government contract performed by the Contractor or a subcontract thereunder, the Contractor has credible evidence that a principal, employee, agent, or subcontractor of the Contractor has committed a violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 U.S.C. or a violation of the civil False Claims Act (31 U.S.C. 3729-3733).
(G) Full cooperation with any Government agencies responsible for audits, investigations, or corrective actions.
ETHICS TRAINING PROGRAM
Of the three components of a contractor ethics program, the training program is the least defined in the FAR. It is not required for small businesses nor for commercial item contracts as we shall see in Chapter 2.
FAR does not describe what topics must be included in the training. Obviously, the training program would inform employees about the code of business ethics and how to comply with it.
Although the FAR says little about what such a program should look like, FAR gives some details as to who should receive training:
The training conducted under this program shall be provided to the Contractor’s principals and employees, and as appropriate, the Contractor’s agents and subcontractors. FAR 52.203-13(c)(1)(ii).
That same FAR clause defines two of these terms:
Agent means any individual, including a director, an officer, an employee, or an independent contractor, authorized to act on behalf of the organization.
Principal means an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager; head of a subsidiary, division, or business segment, and similar positions). FAR 52.203-13(a).
The training program component is somewhat vague. Although the FAR Councils’ comments in the 2008 changes provide helpful information on other topics, they provide little elaboration on what this training program should look like. One comment to the FAR Councils complained that:
… the requirements for training could take substantial time away from performing on their contracts to train staff on an unknown scope of Federal criminal law. The Government would incur costs from this activity through delays in the fulfillment of contracts and increased contractor expenses that will be passed along to customers.
In its response, the FAR Councils asserted that enough guidance had been given:
By identifying the scope of violations of the Federal criminal law as those involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code, the Councils believe that the training requirements have been more clearly defined and the contractor’s training requirement has been reduced. 73 FR 67067.
In another response, the FAR Councils stated:
The Councils do not agree that it is necessary under this case to dictate to contractors what they need to cover in business ethics training. If we highlight education on the civil FCA, or other specific areas, the contractors may place undue emphasis only on those areas mentioned in the regulations. The business ethics training courses may cover appropriate education on the civil FCA, as well as many other areas such as conflict of interest and procurement integrity and other areas determined to be appropriate by the contractor, considering the relevant risks and controls. 73 FR 67067.
Bottom line: Companies are on their own in designing the training program that must cover the four criminal laws mentioned above plus the civil False Claims Act. These laws are discussed in detail in Chapters 5 and 6.
Explore how to assess a wide range of factors to determine which contract type will provide the government the best value...
Transform your workplace into a well of learning and employee potential fulfilled with the help of this book!
Use past performance to win contracts at the lowest risk and cost
Learn project management processes, tools, and techniques that are scalable and adaptable to small projects.