Federal Regulations Now Require All Government Contractors To Have A Comprehensive Compliance Program

Contractor compliance programs are now mandatory. In March 2007, our Client Alert "PROPOSED FEDERAL REGULATIONS WOULD REQUIRE ALL GOVERNMENT CONTRACTORS TO HAVE A COMPLIANCE PROGRAM," advised you about proposed additions to the Federal Acquisition Regulations ("FAR") that would require virtually all prime and subcontractors with government contracts to institute comprehensive ethics and compliance programs. On November 23, 2007, the government announced that the proposed regulations have become final in essentially the same form as proposed.

In another important development, the government issued more proposed FAR ethics and compliance regulations on November 14, 2007, that would expand the final regulations that were just adopted.

These initiatives are elements of the federal government's ongoing commitment to root out fraud, waste, and abuse in contracting on federally funded projects. This commitment is reflected in the Department of Justice's creation of its "National Procurement Fraud Task Force" in October 2006 and in recent court decisions that have placed construction contractors in the spotlight for violations of the false claims and anti-kickback laws. We covered these in our Client Alerts "GOVERNMENT CONTRACTORS BEWARE! U.S. DEPARTMENT OF JUSTICE AND OTHER FEDERAL AGENCIES HAVE RECENTLY LAUNCHED A BROAD NEW INITIATIVE TO INVESTIGATE AND PROSECUTE GOVERNMENT CONTRACTORS' PROCUREMENT FRAUD" (October 2006) and "NEW STAKES IN DOING BUSINESS WITH THE FEDERAL GOVERNMENT" (February 2007). This article provides you with the details of the final FAR regulations and the newly proposed FAR regulations.

The New Final FAR Regulations

Effective December 24, 2007, the new FAR Subpart 3.10, "Contractor Code of Ethics and Business Conduct," imposes the following requirements on all government contractors (prime and subcontractors), regardless of the contracting agency, who receive a contract award in excess of $5 million with a performance period of at least 120 days.

• Within 30 days after contract award, contractors must have a written code of ethics and business conduct. This time period could be extended by the contracting officer. A copy would have to be provided to "each employee engaged in the performance of the contract."

• Within 90 days after contract award, contractors must have instituted an employee ethics and compliance training program and internal control systems. This time period could be extended by the contracting officer.

• Contractors must display a hot line poster "in common work areas" within the business units performing the contract subject to the FAR compliance regulations and on the company's website if the company conveys information to employees via its website.

• Under the final regulations, contractors are required to have a compliance program that:

This means that a contractor's system of internal controls should provide for:

• Periodic reviews of company business practices, procedures, policies, and internal controls for compliance with the contractor's code of ethics and business conduct and the special requirements of government contracts.

• An internal reporting mechanism, such as a hotline, by which employees may report suspected instances of improper conduct, and instructions that encourage employees to make such reports,

• Internal and/or external audits, as appropriate, and

• Disciplinary action for improper conduct.

Exemptions. Contracts to be performed outside the United States and contracts for "commercial items" (generally, commercial off-the-shelf items) are exempt, along with contracts that do not meet the dollar or performance period thresholds. Companies that qualify as small businesses are partially exempt; they are not required to have a formal training program and internal controls, but are still subject to the general requirement for a code of business conduct that must be distributed to all employees.

Self-Reporting Requirement. The final FAR regulations do not address the controversial self-reporting requirement that would have required contractors to report their own suspected violations of criminal laws and other contracting irregularities. Instead, the self-reporting requirement will be considered when the newly proposed amendments to the FAR regulations are considered, as discussed below. So, for now, the FAR does not require self-reporting, although existing FAR regulations require contractors to self-report violations of the Anti-Kickback Act and in certain circumstances contractors may find it advantageous to make a voluntary disclosure of wrongdoing.

Flow down to Subcontractors. Prime contractors are required to "flow down" to subcontractors that meet the threshold requirements and are not otherwise exempt the same requirements that apply to prime contractors. The drafters of the final FAR provision make it clear that this requirement applies to all subcontractors, vendors and other similar parties. The FAR drafters stated: "Sometimes construction firms think that 'subcontract' does not include purchase orders. The FAR does not make this distinction. The intent is that the flowdown applies to all subcontracts, including purchase orders."

The FAR drafters also addressed the thorny issue of the degree of oversight a prime contractor must exercise over its subcontractors. The FAR drafters stated: "The contractor is not required to judge or monitor the ethics awareness program and internal control systems of the subcontractors-just check for existence. The difficulty of a small business concern monitoring a large business subcontractor is true with regard to many contract requirements, not just this one." Thus, although prime contractors will not be required to continually monitor subcontractors compliance programs, they will be required to review them initially. Disclosure by subcontractors is another issue that will be considered in connection with the newly proposed FAR amendments.

Failure to Comply. The final rule does not specify the penalties for failing to comply with these FAR requirements. Instead, the FAR drafters stated, somewhat ominously, that: "The FAR already provides sufficient remedies for breach of contract requirements."

The Newly Proposed FAR Regulations

At the request of the Department of Justice, the FAR Councils issued on November 14, 2007, proposed FAR regulations that would provide more specificity to the requirements of the compliance regulations that were just finalized and would address the self-disclosure requirement. The newly pro-posed FAR regulations would supplement, not replace, the recently finalized FAR regulations.

As with the final FAR regulations, the proposed FAR regulations would also be applicable to all prime contracts and subcontracts, regardless of the contracting agency, that are expected to exceed $5 million with a performance period of at least 120 days. The same exemptions would also apply to small businesses and to contracts for commercial items and contracts to be performed outside the United States. As a general policy, the regulations state that, "Government contractors must conduct themselves with the highest degree of integrity and honesty."

Evaluation of Bidders/Debarment. Ethical violations will be considered in past performance evaluations of bidders. Also, contractors may be suspended and/or debarred for a "knowing failure to timely disclose an overpayment on a Government contract or violation of Federal criminal law in connection with the award or performance of any Government contract or subcontract."

Code of Business Ethics and Conduct. The requirement to have a written code of business ethics and conduct within 30 days after contract award and to provide a copy of the code to each employee engaged in performance of the contract is the same as in the final regulations. In addition, the contractor shall­ -

• Exercise due diligence to prevent and detect criminal conduct; and

• Otherwise promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law.

Business ethics awareness and compliance program and internal control system for other than small businesses. Again, the requirements are the same as those in the final regulations. In addition, the proposed regulations state:

• This program shall include reasonable steps to communicate periodically and in a practical manner the contractor's standards and procedures and other aspects of the contractor's business ethics awareness and compliance program and internal control system, by conducting effective training programs and otherwise disseminating information appropriate to an individual's respective roles and responsibilities.

• The training conducted under this program shall be provided to the Contractor's principals and employees, and as appropriate, the contractor's agents and subcontractors.

Internal Control System. The contractor's internal control system must:

• Establish standards and procedures to facilitate timely discovery of improper con-duct in connection with government contracts; and

• Ensure corrective measures are promptly instituted and carried out. At a minimum, the contractor's internal control system must provide for the following:

• Assignment of responsibility at a sufficiently high level of the organization and adequate resources to ensure effectiveness of the business ethics awareness and compliance program and internal control system.

• Reasonable efforts not to include within the organization principals whom due diligence would have exposed as having engaged in conduct that is illegal or otherwise in conflict with the contractor's code of business ethics and conduct.

• Periodic reviews of company business practices, procedures, policies, and internal controls for compliance with the contractor's code of business ethics and conduct and the special requirements of government contracting, including:

• An internal reporting mechanism, such as a hotline, which allows for anonymity or confidentiality, by which employees may report suspected instances of improper conduct, and instructions that encourage employees to make such reports.

• Disciplinary action for improper conduct or for failing to take reasonable steps to prevent or detect improper conduct.

Subcontracts. Contractors must include the substance of the same requirements in all subcontracts that meet the threshold dollar and performance period requirements.

Self Disclosure. The contractor must "timely report" in writing, to the agency Office of the Inspector General, with a copy to the Contracting Officer, whenever the contractor has reasonable grounds to believe that a principal, employee, agent, or subcontractor of the contractor has committed a violation of Federal criminal law in connection with the award or performance of this contract or any subcontract under the contract.

Contractors must also provide "full cooperation with any Government agencies responsible for audit, investigation, or corrective actions."

Bottom Line

Instituting and implementing an effective compliance program is now an integral and essential part of doing business with the federal government. The FAR regulations finalized effective December 24, 2007, coupled with the proposed FAR regulations on November 14, 2007, will mean that prime and subcontractors must have in place - within a short time after award of a contract over $5 million and a performance period of at least 120 days - a comprehensive compliance program replete with a code of ethics and conduct, educational programs, compliance audits, anonymous reporting, and other internal controls. Plus, prime contractors will be required to ensure that any subcontractors meeting the dollar and performance period thresholds have the same type of compliance program.

Yet to be determined is the perilous issue of self-disclosure. If contractors are required to report to the government their own potential criminal violations, the attorney client privilege will, at a minimum, become a challenge to maintain and in some circumstances could be placed in jeopardy if contractors are effectively conscripted into policing and prosecuting themselves.

The world of government contracting is not for the faint of heart, the uninformed or the unprepared. The Corporate Ethics and Compliance Practice Group of Peckar & Abramson has been actively counseling existing and new clients about retooling their business practices and controls so that they can meet the government's new ethics and compliance requirements.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.