On December 24, 2007, a new Federal Acquisition Regulation (FAR) rule requiring a contractor code of ethics and other elements of a compliance and ethics program became effective.1This final rule requires contractors to have a code of business ethics and conduct within 30 days of award of all non-commercial-item contracts and subcontracts greater than $5 million and with a performance period of 120 days or more. It also requires formal training on the code, internal controls to detect improper conduct and the display of hotline posters. Although this final rule requires some elements of a compliance and ethics program, as defined by the U.S. Sentencing Guidelines (USSG), it does not meet all of the USSG's requirements for an effective program. In comments on the original proposed rule, the Department of Justice (DOJ) proposed a further rule that would mandate compliance programs that met the Sentencing Commission guidance, along with additional requirements.
In response to the DOJ comments, the FAR Councils have proposed to amend the FAR again to require contractors to have and implement additional components of a compliance program that meets the "effectiveness" criteria under the USSG. This proposed rule also would make mandatory the disclosure of suspected wrongdoing and would require "full cooperation" with any government investigation. As explained in more detail below, this proposed rule requires far more than the USSG expects from a comprehensive compliance and ethics program, and the additional burdens on contractors could cause major problems if the rule is adopted without significant modification.
Requirements Of The Proposed Rule
On November 14, 2007, the Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (the Councils) published the proposed amendments to the FAR.2This proposed new rule was requested by the DOJ, which believed that the Councils' earlier proposed rule - and now final rule - requiring only some components of a compliance program left out important elements contained in the USSG's description of an effective compliance and ethics program.3The new proposed rule requires contractors:
• to have all of the elements of an effective and comprehensive compliance and ethics program, with the FAR requirement using the same or similar language employed by the USSG;
• to "notify, in writing, the agency Office of Inspector General with a copy to the Contracting Officer, whenever the Contractor has reasonable grounds to believe that a principal, agent or subcontractor of the Contractor has committed a violation of Federal criminal law in connection with the award or performance of this contract or any subcontract thereunder" (emphasis added);
• to make "[f]ull cooperation with any Government agencies responsible for audit, investigation, or corrective actions"
Exceptions to these requirements include the following: they will not apply to (1) contracts of $5 million or less; (2) those with a performance period of fewer than 120 days; (3) those performed entirely outside the United States; (4) or commercial item contracts under FAR Part 12. Even if the contract would otherwise be covered, these requirements are not applied to small business concerns.
Mandatory Self-Disclosure
The proposed rule requires a contractor to notify the Office of Inspector General (IG) whenever it has "reasonable grounds to believe" a criminal violation has occurred. Penalties for non-disclosure are suspension and even debarment - the proposed rule would add two newly stated types of contractor omissions to the lists of causes for suspension or debarment under FAR 9.407-2 and 9.406-2, so long as the existence of the omissions is based upon "a preponderance of the evidence":
1) a "knowing failure" to "timely" disclose an "overpayment" on a government contract
2) a "knowing failure" to "timely" disclose a "violation of Federal criminal law in connection with the award or performance of any Government contract or subcontract"
The proposed rule includes no definition of "timely." This raises additional questions:
• When does a necessary disclosure become late?
• Is the contractor entitled first to consult with its legal counsel, its cost accounting expert and others, and self-investigate the situation before it concludes that there has been an "overpayment" or a "violation of Federal criminal law?"
• And if the contractor does not have such professionals on its corporate staff or in an outside firm with a history of work for the company, how much time would be afforded the contractor to seek such professional assistance?
• When is a failure to disclose "knowing?" Who decides? What about reasonable disagreements over whether there has been a violation?
There is no definition of "overpayment." Federal contracts have many pricing methods and systems for interim or provisional payments. Does an "overpayment" occur when a provisional payment such as a cost-reimbursement voucher is paid, even though the final amount for that voucher as determined at the end of the contract might be higher or lower than what the contractor had claimed for that voucher? Has an "overpayment" occurred when payment dollars pertaining to one line item appear to be excessive, but another line item was shortchanged by the government disbursing office in the exact same amount? These questions are not answered by the plain language of the proposed rule.
Moreover, irrespective of the wording in this proposed rule, the entire notion of mandatory disclosure runs counter to many established government processes. For example, unlike most of the compliance program elements required by the new rule, mandatory self-disclosure is not an element of a compliance program under the USSG. Rather, voluntary self-disclosure is one factor in the mitigation of a company's culpability under the USSG.
Mandatory self-disclosure is also at odds with the DOJ's own corporate-charging guidelines for its federal prosecutors. The McNulty Memorandum, issued December 12, 2006, by then-Deputy U.S. Attorney General Paul McNulty, specifically states that "prosecutors must consider" in their charging decision "the corporation's timely and voluntary disclosure of wrongdoing and its willingness to cooperate in the investigation of its agents."4
Nor does the Defense Acquisition Regulation Supplement (DFARS) require reporting suspected violations straight to the IG level. Rather, the DFARS states that a "contractor's system of management controls should provide for[t]imely reporting to appropriate Government officials of any suspected or possible violation of law in connection with Government contracts."5 Thus, where appropriate, contractors may make a voluntary disclosure to the contracting officer, the program manager, the contract administrator or some combination thereof. The IG may be notified, but need not be unless appropriate.
More broadly, requiring disclosures to the agency IG would seem to defeat the concept of ameliorating possible irregularities. Once the IG has become involved, both the contracting officer and the contractor or subcontractor may lose control of the investigation into what went wrong on the contract and what entity was responsible. It does not seem to be good policy to require immediate reporting to an IG office at the outset of the contractor's developing the threshold "reasonable grounds to believe" - a phrase which could have varying interpretations and is a lower standard than "probable cause." It could be based upon completely unevaluated or investigated allegations, rumors and suspicions. The existing voluntary disclosure protocols, in contrast, allow for internal investigation by the reporting parties before a disclosure is made.
Other federal agencies also currently have provisions encouraging voluntary self-disclosure. For example, the HHS-OIG's Provider Self-Disclosure Protocol was implemented in October 1998 to assist health care providers in investigating and reporting potential violations of federal health care laws. The program presents providers with an opportunity to police themselves, correct underlying problems and work cooperatively with the government to resolve any matters of concern.
Perhaps the biggest concern about mandatory disclosure - with looming penalties of suspension and debarment - is that it will inhibit "good" companies from entering the federal market, while likely leading to only marginally more reporting, if any. With a voluntary disclosure system, the "good" companies will naturally disclose concerns to authorities, whereas the "bad" companies will not. With mandatory disclosure, however, the "good" companies will still disclose - because it is required - and the "bad" companies still will not disclose. Plus, the threat of suspension and debarment and the potentially massive costs of responding to an investigation will keep some "good" companies from bidding on government contracts in the first place.
Thus, in order to maintain consistency with other federal agencies and the USSG's widely known compliance program elements, and to keep ethical companies from being scared away by business-killing penalties, the Councils would be wise to consider a voluntary disclosure program instead.
"Full Cooperation"
The proposed rule also requires "[f]ull cooperation with any Government agencies responsible for audit, investigation, or corrective actions." This statement lacks any explanation, definition, or clarification, however, and raises additional questions:
• What is "full cooperation," as opposed to mere "cooperation?"
• Does "full cooperation" require waiver of the attorney-client privilege and work product protections?
• What are "corrective actions," apart from audits and investigations?
If "full cooperation" does mean a complete waiver of the attorney-client privilege and work product protections, this proposed rule would run counter to the DOJ's guidance to its own prosecutors. As mentioned above, the McNulty Memorandum notes that a company's "willingness to cooperate" should be a factor in the prosecutor's charging decision. The McNulty Memorandum further states that "[t]he attorney-client and work product protections serve an extremely important function in the U.S. legal system" and that "[w]aiver of attorney-client and work product protections is not a prerequisite to a finding that a company has cooperated in the government's investigation."6The absence of such a sacrosanct, shielding privilege could also have the effect of deterring a contractor's employees from reporting any potential or suspected wrongdoing, or from hiring competent counsel to conduct internal investigations. Thus, the requirement of "full cooperation" could actually lead to fewer reports in the end.
It is entirely possible that the Councils did not intend to require waiver of the attorney-client privilege and work product protections through their use of the phrase "full cooperation." However, absent any clarifying language, the requirement is too easily expanded and can be used to justify such a demand. It would, therefore, benefit all involved if the Councils would add definitions or otherwise clarify the "full cooperation" requirement. The government should be encouraging voluntary cooperation and taking it into account in suspension and debarment decisions, but mandatory cooperation is both counterintuitive (if it is mandatory, it is not cooperation) and counterproductive.
1 See Federal Acquisition Regulation; FAR Case 2006-007, Contractor Code of Business Ethics and Conduct, 72 Fed. Reg. 65,873 (Nov. 23, 2007).
2 See Federal Acquisition Regulation; FAR Case 2007-006, Contractor Compliance Program and Integrity Reporting, 72 Fed. Reg. 64,019 (Nov. 14, 2007).
3 See USSG § 8B2.1.
4 McNulty Memorandum at 4 (Dec. 12, 2006) (emphasis added).
5 DFARS § 203.7001(a)(6) (emphasis added).
6 McNulty Memorandum at 8 (emphasis added).
Published June 1, 2008.
