// By David H. Laufman

Introduction
The government’s aggressive enforcement approach to government contracting fraud is now reaching directly into the internal policies and operations of contracting companies. Earlier this month, the Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council issued a proposed rule to amend the Federal Acquisition Regulation (FAR) to establish new ethics standards and internal control procedures for government contractors [72 Fed Reg. 64,019 (Nov. 14, 2007)].

The proposed rule, issued at the request of the Department of Justice (DOJ), imposes three new regulatory requirements on government contractors:

• To have a code of ethics and business conduct;
• For large companies, to establish and maintain specific internal controls to detect and prevent improper conduct in connection with the award of performance of government contracts or subcontracts; and
• To notify the government without delay whenever they become aware of violations of federal criminal law with regard to contracts or subcontracts.

Written comments on the proposed rule must be submitted to the FAR Secretariat on or before January 1, 2008.

Contractor Requirements
The proposed rule contains “guidance” for all contractors, including small businesses, regarding internal ethics policies. After offering the principle that government contractors “must conduct themselves with the highest degree of integrity and honesty,” it establishes several specifics.
Except for small businesses, contractors must establish a business ethics awareness and compliance program and an internal control system within 90 days after contract award, unless the contracting officer establishes a longer time period.

The business ethics awareness and compliance programs must include “reasonable steps to communicate periodically and in a practical manner the Contractor’s standards and procedures and other aspects of the Contractor’s business ethics awareness and compliance program and internal control system. . . .” The Contractor must accomplish this by “conducting effective training programs and otherwise disseminating information appropriate to an individual’s respective roles and responsibilities.” Such training must be provided not only to the Contractor’s principals and employees, but also, “as appropriate,” to its agents and subcontractors.

In addition to a written code of business ethics and conduct, government contractors should have in place an ethics compliance training program and an appropriate internal control system to ensure that misconduct is detected quickly and corrective action taken promptly.”

Internal Control System
The contractor’s internal control system must be multifaceted. It must “establish standards and procedures to facilitate timely discovery of improper conduct in connection with government contracts,” and to “ensure corrective measures are promptly instituted and carried out.” At a minimum, the contractor’s internal control system must incorporate seven measures to prevent and detect violations of law:

1. To assign responsibility “at a sufficiently high level of the organization and adequate resources to ensure effectiveness of the business ethics awareness and compliance program and internal control system”
2. To provide for “reasonable efforts not to include within the organization principals whom due diligence would have exposed as having engaged in conduct that is illegal or otherwise in conflict with the Contractor’s code of business ethics and conduct”
3. To call for periodic reviews of company business practices, procedures, policies, and internal controls for compliance with the Contractor’s code of business ethics and conduct “and the special requirements of Government contracting,” including:
   • Monitoring and auditing to detect criminal conduct;
   • Periodic evaluation of the effectiveness of the organization’s business ethics awareness and compliance program and internal control system, “especially if criminal conduct has been detected”; and
   • Periodic assessment of the risk of criminal conduct, with “appropriate steps” to design, implement, or modify the business ethics awareness and compliance program and the internal control system “as necessary to reduce the risk of criminal conduct identified through this process”;
4. To provide both for an internal reporting mechanism, such as a hotline, “which allows for anonymity or confidentiality, by which employees may report suspicious instances of improper conduct,” and provide employees with “instructions that encourage employees to make such reports”
5. To require disciplinary action for improper conduct “or for failing to take reasonable steps to prevent or detect improper conduct”
6. To require “timely reporting,” in writing, to the agency OIG and contracting officer, “whenever the contractor has reasonable grounds to believe that a principal, employee, agent, or subcontractor…has committed a violation of federal criminal law in connection with the award or performance of any government contract performed by the contractor or a subcontractor thereunder”(According to DOJ, this mandatory disclosure requirement “is necessary because few companies have actually responded to the invitation of DOJ that they report or voluntarily disclose suspected instances[s] of violations of federal criminal law relating to the contract or subcontract.” The Councils observe that a contractor’s disclosure under the mandatory disclosure requirement “would probably involve legal assistance to prepare.”);
7. To require “full cooperation with any Government agencies responsible for audit, investigation, or corrective action”(For this requirement, the Councils specifically have invited “public comment and analysis” with respect to whether “full cooperation” could result in “waiver of the attorney-client privilege.”)

Contract Clause
Although the requirements to establish the training program and internal control system constitutes merely “guidance,” the DOJ has mandated that solicitations and contracts include the ethics and compliance provisions to reflect similar factors in the U.S. Sentencing Guidelines. This means that if the proposed rule is adopted, contracting companies would be on direct notice that, in the event of a criminal conviction, they will face greater obstacles in seeking lenience at sentencing if they have not fully complied with the ethics and internal accountability provisions explicitly contained in their contracts.

The new ethics and compliance clause is required only if the value of the contract is expected to exceed $5 million and the performance period is 120 days or more. This clause is not required, however, in contracts for the acquisition of a commercial item (awarded under FAR Part 12) or in contracts performed entirely outside the United States. Therefore, the ethics and internal controls clause does not need to be included in solicitations or contracts for service contracts to be performed entirely in Iraq or Afghanistan. The Councils “estimate that this clause will apply to 1,800 prime contractors per year, of which 700 companies are small business concerns.”

The solicitations and contracts clause requires that the contractor will:

• Exercise due diligence to prevent and detect criminal conduct;
• Promote ethics and compliance;
• Within 30 days after contract award, provide a written code of business ethics and conduct to each employee engaged in performance of the contract; and
• Notify the OIG and the contracting officer in writing if it has any reasonable grounds to believe any potential violations of federal or criminal law have occurred in connection with the contract.

The notification requirement applies to violations committed by employees, agents, and subcontractors, as well as principals- officers, directors, owners, partners, and persons with primary management or supervisory responsibilities down to the level of a plant manager.

Contractor Qualifications
At DOJ’s request, the rule proposes to amend the general standards of responsibility to treat a contractor’s record of “integrity and business ethics” as relevant information to be included in past performance information. The proposed rule states that “contractors that have had prior contracts subject to these new requirements, compliance as reflected in past performance rating will be an element for consideration in assessing whether a contractor meets the standard of integrity and business ethics.”

Consequences for Non-Disclosure of Violations
Violating the rule could result in elimination from current award evaluations, suspension of current contracts, and debarment from future government contracts. The proposed rule imposes new harsh penalties for non-disclosure of certain contractor misconduct, specifically:

• An overpayment on a government contract; and
• Violation of Federal criminal law in connection with the award or performance of any Government contract or subcontract.

Note that “the requirement for mandatory reporting is limited to violations of federal criminal law in connection with performance or award of a government contract or subcontract, rather than requiring report of any improper conduct, even that which is not a violation of federal criminal law.”)

Non-compliance could result in elimination from current award evaluations, suspension of current contracts, and debarment from future government contracts. The rule provides for suspension “upon adequate evidence” that a contractor has knowingly failed to timely disclose the misconduct, and for debarment if there is a preponderance of the evidence that a contractor has knowingly failed to disclose.

Prudential Actions for Contracting Companies
In anticipation that the proposed rule will become final in the coming months, contracting firms that do not already have a code of business ethics and internal controls system program in place to detect and preclude criminal misconduct should take steps now to establish them. Those companies with such measures already in effect should reexamine them to assess whether they fully satisfy the impending requirements of the new regulatory scheme.

David H Laufman is a partner at Kelley Drye Collier Shannon in Washington, D.C., specializing in corporate compliance and government investigations. He previously served as an Assistant United States Attorney in the Eastern District of Virginia, as Chief of Staff to the Deputy Attorney General, and as Investigative Counsel to the House Committee on Standards of Official Conduct (”House Ethics Committee”).