April 24, 2008

Final Rule: Contractor Code of Business Ethics and Conduct
Proposed Rule: Contractor Compliance Program and Integrity Reporting

The ethics of companies doing business with the government and their compliance with standard government contract requirements has become daily fare in the media, congressional hearings, and audit reports issued by the Government Accountability Office  and the agency Inspector Generals. Two new and related Federal Acquisition Regulation rules-one final and one proposed-are the most recent manifestations of this new focus on contractor ethics and compliance.

The first is a recently published final rule requiring contractors to maintain a written code of business ethics and conduct a sound practice for any business (whether or not it sells to the government). The second and more significant is a proposed rule that would require contractors to maintain a compliance program that moves beyond the final rule and includes specific integrity reporting requirements converting actions that in the past were purely voluntary into contractual obligations, and thereby raising significant practical and even Constitutional concerns. The proposed rule is a response to current congressional and Department of Justice concerns regarding the integrity of the procurement process.

FINAL RULE:
Contractor Code of Business Ethics and Conduct
(FAR Case 2006-007; 72 Fed. Reg. 65873)

Originally proposed on February 16, 2007 (72 Fed. Reg. 7588), FAR Case 2006-007 received 27 substantive public comments, most of which expressed general approval of a rule that would require most companies doing business with the government to establish codes of business ethics and conduct, and provide appropriate training for their employees. Many of the comments, however, questioned specific features of the rule or suggested changes to the version as proposed.

The final rule, issued on November 23, 2007 (72 Fed. Reg. 65873), includes the following fundamental guidance:

3.1002 Policy

(a) Government contractors must conduct themselves with the highest degree of integrity and honesty.
(b) Contractors should have a written code of business ethics and conduct. To promote compliance with such code of business ethics and conduct, contractors should have an employee business ethics and compliance training program and an internal control system that-
(1) Are suitable to the size of the company and extent of its involvement in Government contracting;
(2) Facilitate timely discovery and disclosure of improper conduct in connection with Government contracts; and
(3) Ensure corrective measures are promptly instituted and carried out.

While the final rule provides guidance to all companies who do business with the government -- as either a prime or subcontractor -- its requirements are mandatory only for contractors performing contracts expected to exceed $5,000,000 and extend over more than 120 days. Two types of contracts are exempt: (i) acquisitions of commercial items under FAR Part 12; and (ii) contracts performed entirely outside the US. See FAR 3.1004.

Those companies covered by the final rule are required to have a written code of business ethics and conduct as well as a business ethics and compliance awareness (training) program and an internal control system. Another significant feature of the final rule is a requirement to flow the new contract clause containing the same obligations down to subcontractors who are not otherwise exempt. See FAR 52.203-13. While the obligation must be flowed down, the prime is responsible only for determining whether its subcontractor has the required code of business ethics and conduct, not with verifying the subcontractor's compliance with that code. In addition, small business concerns are exempt in the new clause from the requirement to establish an awareness program and internal control system as part of their code.

The end product of the final rule is that prime and subcontractors will, in many cases, be required to maintain codes of business ethics and conduct. What was merely encouraged under the Defense FAR Supplement in the past, is now mandatory. For publicly traded companies subject to the Sarbanes-Oxley Act, the final rule is not likely to require additional action.

PROPOSED RULE:
Contractor Compliance Program and Integrity Reporting
(FAR Case 2007-006; 72 Fed. Reg. 64019)

On November 14, 2007, a proposed FAR rule was published that will expand the requirements set forth in the final rule above by requiring contractors to include additional elements in their codes of business ethics and conduct and internal control systems. The basis for the proposed rule was explained as follows:

[The Civilian Agency and DAR Councils] are proposing to amend the Federal Acquisition Regulation (FAR), at the request of the Department of Justice (DoJ), in order to require contractors to have a code of ethics and business conduct, establish and maintain specific internal controls to detect and prevent improper conduct in connection with the award or performance of Government contracts or subcontracts, and to notify contracting officers without delay whenever they become aware of violations of federal criminal law with regard to such contracts. (Emphasis added.)

72 Fed. Reg. 64019. The changes being made in the new proposed rule were suggested in a May 23, 2007 DoJ letter to the Councils. The most controversial portions of the proposed rule are those which require the "disclosure" of improper conduct and full cooperation with the government.

As in the case of the final rule, prime and subcontractors selling commercial items or performing their prime or subcontract entirely outside the U.S. are exempt from the proposed rule. For those who are covered, however, the proposed rule will modify the final rule above by adding the following features:

• The contract clause promulgated as part of the final rule at FAR 52.203-13 will be modified to describe the requirements of a contractor's Code of Ethics and Business Conduct to more closely coincide with the elements in the U.S. Sentencing Commission Guidelines Manual.
  Comments regarding this proposed change have generally been favorable.
  A satisfactory record of integrity and business ethics will become part of the responsibility factors in FAR 9.104-1.
• A contracting officer can thus disqualify a contractor from an award when he/she determines that the contractor's record of integrity and business ethics is unsatisfactory. The standard for making this determination is vague and subjective, the penalty - ineligibility for contract award - is severe, and the contractor's options for recourse are uncertain.
• The elements of the required contractor internal control system will become mandatory, and the list of elements of such a system is to include:

(F) Timely reporting, in writing, to the agency Office of Inspector General, with a copy to the Contracting Officer, whenever the Contractor has reasonable grounds to believe that a principal, employee, agent, or subcontractor to the Contractor has committed a violation of Federal criminal law in connection with the award or performance of any Government contract performed by the Contractor or a subcontract thereunder; and
(G) Full cooperation with any Government agencies responsible for audit, investigation, or corrective actions. (Emphasis added.)

See proposed FAR 52.203-13.

There are many issues raised by the disclosure and cooperation requirements. One is the imprecision and subjectivity of the standard. For example, if a contractor suspects that the conduct of its employees might be construed to be a false claim, how is it to determine that the conduct constitutes a violation of criminal law-as opposed to a civil sanction under the False Claims Act? Another issue is how the requirements implicate both the contractor's and its employees' Constitutional rights-for example, rights against self-incrimination. The timing of such a disclosure is also unclear. For example, are contractors free to perform their own internal investigations of alleged wrongdoing before going to the government?

The definition of "full cooperation" is also unclear. Will contractors be expected to waive attorney-client privilege as part of this obligation? That question involves a separate subject of controversy involving DoJ policy first described in the 2003 "Thompson Memorandum" in which prosecutors were told that a corporation's willingness to waive privilege was a factor to be considered in making charging decisions. While the DoJ revised the Thompson Memorandum a year ago to place procedural limits on prosecutors seeking such waivers, the Congress has taken initial steps to further protect contractors from this type of pressure from DoJ.¹

• Failure to timely disclose an overpayment by the government, or a "violation of Federal criminal law in connection with the award or performance of any Government contract or subcontract" will become a basis for suspension or debarment under FAR 9.407-2(a) and FAR 9.406-2(b)(1), respectively.

This section puts teeth in the disclosure and cooperation rules described above. Failure to make those disclosures and cooperate will lead to a sanction-suspension or debarment. This section thus converts the suspension and debarment process into a penalty, which is not its intended purpose.

The last three changes above have generated substantial comment and controversy.² DoJ argues that while disclosure of violations of law has been the policy within many companies and was encouraged under the DFARS, in recent years too few contractors made disclosures, thus requiring the proposed change to mandate disclosure and cooperation. See 72 Fed. Reg. 64020. The fact the number of voluntary disclosures has dropped in recent years can be explained by other factors, and DoJ has not, up to this time, supported its conclusions.

There is reason to believe that some of these questions may be answered in whole or in part when the final rule (or perhaps a new proposed rule) is published. DoJ itself has submitted comments to the proposed rule in which it suggested changes to clarify the scope and application of the rule. As a result, it is almost certain that the next version of the rule will be different in form than that proposed in November 2007.

Conclusion

Well thought out codes of business ethics and conduct, and training to explain and reinforce those requirements are good business. Meaningful and effective compliance and ethics programs are important for all companies, but they are especially important for companies doing business with the government as either a prime or subcontractor. The proposed rule, however, goes beyond the traditional approach that has allowed contractors to run their own businesses-including the establishment of ethics and compliance programs in a way that makes sense in their circumstances. Mandating morality as a contract requirement moves the government into a new and questionable procurement role.

NOTES

¹ See H.R. 3013, which was approved by House on November 13, 2007, would prohibit the DoJ from pressuring corporations to waive privilege. See also S. 186 which reflects the same requirement.

² For example almost every contractor trade association has submitted comments criticizing the proposed rule. In addition, the ABA's Section of Public Contract law submitted written comments on January 18, 2008 that are largely critical of the proposed rule and fill 27 pages.

If you have any questions about this Alert, please contact one of the attorneys listed below.

Gregory A. Smith - Reston, VA
Kevin Mullen - Washington, DC