E8-26953. Federal Acquisition Regulation; FAR Case 2007-006, Contractor Business Ethics Compliance Program and Disclosure Requirements

AGENCIES:

Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA).

ACTION:

Final rule.

SUMMARY:

The Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (Councils) have agreed on a final rule amending the Federal Acquisition Regulation (FAR) to amplify the requirements for a contractor code of business ethics and conduct, an internal control system, and disclosure to the Government of certain violations of criminal law, violations of the civil False Claims Act, or significant overpayments. This final rule implements Pub. L. 110-252, Title VI, Chapter 1.

DATES:

Effective Date: December 12, 2008.

Applicability: The Contractor's Internal Control System shall be established within 90 days after contract award, unless the Contracting Officer establishes a longer time period (See FAR 52.203-13(c)). The Internal Control System is not required for small businesses or for commercial item contracts.

FOR FURTHER INFORMATION CONTACT:

Mr. Ernest Woodson, Procurement Analyst, at [phone] for clarification of content. For information pertaining to status or publication schedules, contact the FAR Secretariat at [phone]. Please cite FAC 2005-28, FAR case 2007-006.

SUPPLEMENTARY INFORMATION:

Table of Contents

A. Background

B. Discussion and Analysis

1. Interrelationship of previous final rule, first proposed rule, second proposed rule, and new statute.

2. Mandatory standards for internal control system.

3. Mandatory disclosure to the OIG.

4. Full Cooperation.

5. Suspension/Debarment.

6. Extend to violation of civil False Claims Act.

7. Application to acquisition of commercial items.

8. Application to contracts to be performed outside the United States.

9. Other applicability issues.

10. Additional recommendations.

11. Regulatory Flexibility Act concerns.

12. Paperwork Reduction Act (PRA).

13. E.O. 12866.

C. Regulatory Flexibility Act

D. Paperwork Reduction Act

A. Background

This case is in response to a request to the Office of Federal Procurement Policy from the Department of Justice, dated May 23, 2007, and the Close the Contractor Fraud Loophole Act, Public Law 110-252, Title VI, Chapter 1. This final rule amends the Federal Acquisition Regulation to require Government contractors to—

• Establish and maintain specific internal controls to detect and prevent improper conduct in connection with the award or performance of any Government contract or subcontract; and
• Timely disclose to the agency Office of the Inspector General, with a copy to the contracting officer, whenever, in connection with the award, performance, or closeout of a Government contract performed by the contractor or a subcontract awarded thereunder, the contractor has credible evidence of a violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code; or a violation of the civil False Claims Act (31 U.S.C. 3729-3733).
• The rule also provides as cause for suspension or debarment, knowing failure by a principal, until 3 years after final payment on any Government contract awarded to the contractor, to timely disclose to the Government, in connection with the award, performance, or closeout of the contract or a subcontract thereunder, credible evidence of—

A. Violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code;

B. Violation of the civil False Claims Act; or

C. Significant overpayment(s) on the contract, other than overpayments resulting from contract financing payments as defined in FAR 32.001, Definitions.

DoD, GSA, and NASA published a proposed rule in the Federal Register at 72 FR 64019, November 14, 2007, entitled “Contractor Compliance Program and Integrity Reporting.” The public comment period closed on January 14, 2008. (This was a follow-on case to the final rule under FAC 2005-22, FAR case 2006-007 that was published in the Federal Register at 72 FR 65868, November 23, 2007, effective December 24, 2007.) A second proposed rule was published in the Federal Register at 73 FR 28407, May 16, 2008, entitled “Contractor Compliance Program and Integrity Reporting.” The public comment period on the second proposed rule closed on July 15, 2008.

On June 30, 2008, the Close the Contractor Fraud Loophole Act (Pub. L. 110-252, Title VI, Chapter 1) was enacted as part of the Supplemental Appropriations Act, 2008. This Act requires revision to the FAR within 180 days of enactment, pursuant to 2007-006, “or any follow-on FAR case to include provisions that require timely notification by Federal contractors of violations of Federal criminal law or overpayments in connection with the award or performance of covered contracts or subcontracts, including those performed outside the United States and those for commercial items.” The statute also defines a covered contract to mean “any contract in an amount greater than $5,000,000 and more than 120 days in duration.”

First proposed rule. The first proposed rule, published in the Federal Register on November 14, 2007, proposed the following:

1. New causes for suspension/debarment. A contractor may be suspended and/or debarred for knowing failure to timely disclose—

• An overpayment on a Government contract; or
• A violation of Federal criminal law in connection with the award or performance of any Government contract or subcontract.

2. Changes to the requirement for a code of business ethics and conduct (52.203-XX).

• Amplify the requirement to promote compliance with the code of business ethics.
• Require timely disclosure to the agency Office of the Inspector General (OIG), with a copy to the contracting officer, whenever the contractor has reasonable grounds to suspect a violation of criminal law in connection with the award or performance of the contract or any subcontract thereunder.

3. Mandatory requirements for internal control system based on U.S. Sentencing Guidelines (USSG).

• Provide more detail with regard to the ongoing business ethics awareness and compliance program (see 52.203-XX paragraph(c)(1)).
• Make all the stated elements of the internal control system mandatory, rather than examples (see 52.203-XX (c)(2)(ii)).

A. Add a new paragraph requiring assignment of responsibility within the organization for the ethics awareness and compliance program and internal control system.

B. Require reasonable efforts not to include as principals individuals who have engaged in illegal conduct or conduct otherwise in conflict with the contractor's code of business ethics and conduct.

C. Provide additional detail with regard to the requirement for periodic reviews.

D. Require that the internal reporting mechanism or hotline must allow for anonymity or confidentiality.

E. Provide that disciplinary action will be taken not only for improper conduct, but also for failing to take reasonable steps to prevent or detect improper conduct.

F. Require timely disclosure, in writing, to the agency OIG, with a copy to the contracting officer, whenever the contractor has reasonable grounds to believe that a violation of Federal criminal law has been committed in connection with the award or performance of any Government contract performed by the contractor or the award or performance of a subcontract thereunder.

G. Require full cooperation with any Government agencies responsible for audit, investigation, or corrective actions.

Second proposed rule. The second proposed rule, published in the Federal Register on May 16, 2008, proposed the following:

1. Require inclusion of the clause at FAR 52.203-13 in contracts and subcontracts that will be performed outside the United States.

2. Require inclusion of the clause at FAR 52.203-13 in contracts (and subcontracts) for all acquisitions of a commercial item. However, similar to small businesses, a formal business ethics awareness and compliance program and internal control system are not required in contracts and subcontracts for the acquisition of commercial items.

3. Add a new cause for suspension and/or debarment, i.e., knowing failure to timely disclose the violation of the civil False Claims Act (civil FCA) in connection with the award or performance of any Government contract or subcontract.

The first two of these three proposed changes are now required by statute (Pub. L. 110-252, Title VI, Chapter 1). (As pointed out by one of the respondents, there was an error in the amendatory language in the Federal Register. At FAR 3.1004, the introductory text should have been deleted, rather than showing 5 asterisks, indicating that the introductory text is still present. However, the preamble made our intent very clear and this will be clarified in the final rule).

Rule on Contract Debts. DoD, GSA, and NASA published a proposed rule, FAR case 2005-018, in the Federal Register at 71 FR 62230, October 24, 2006, regarding contract debts. The final rule was published in the Federal Register at 73 FR 53997, September 17, 2008, as part of Federal Acquisition Circular 2005-27. The intent of this rule is to evaluate existing controls and procedures for ensuring that contract debts are identified and recovered in a timely manner, properly accounted for in each agency's books and records, and properly coordinated with the appropriate Government officials.

One of the following payment clauses should be included in each Government solicitation and contract:

—52.212-4, Contract Terms and Conditions—Commercial Items, basic clause and Alternate I.

—52.232-25, Prompt Payment.

—52.232-26, Prompt Payment for Fixed-Price Architect-Engineer Contracts.

—52.232-27, Prompt Payment for Construction Contracts.

These Payment clauses for years have contained the requirement to immediately notify the contracting officer if the contractor becomes aware of any overpayment on a contract financing or invoice payment. Compliance with this requirement fulfills the statutory requirement of Pub. L. 110-252 for timely notification of overpayments.

In addition, under the Contract Debts rule, these Payment clauses were modified to require that if the contractor becomes aware of a duplicate contract financing or invoice payment or if the contractor becomes aware that the Government has otherwise overpaid on a contract financing or invoice payment, the contractor shall—

• Remit the overpayment amount to the payment office cited in the contract along with a description of the overpayment; and
• Provide a copy of the remittance and supporting documentation to the contracting officer.

Because issues of overpayment were addressed in FAR case 2005-018, the Councils did not include additional coverage on contract debt in the subject FAR Case, except for adding—

• Knowing failure to timely disclose significant overpayment as a cause for debarment/suspension as stated at Subpart 9.4 Debarment, Suspension, and Ineligibility; and
• A cross reference at 3.1003(a)(3) to this new cause of suspension/debarment at Subpart 9.4.

B. Discussion and Analysis

The FAR Secretariat received 43 responses to the first proposed rule. The FAR Secretariat received comments on the second proposed rule from 25 respondents of which 15 respondents had also submitted comments on the first proposed rule and 10 respondents were submitting comments for the first time. Overall, 18 of the 53 respondents were from Government agencies, including many responses from agency Offices of the Inspector General (OIG).

In the second proposed rule the Councils specifically requested comments on three issues:

• Elimination of the exemption from inclusion of the clause FAR 52.203-13 for contracts and subcontracts that will be performed entirely outside the United States.
• Elimination of the exemption from inclusion of the clause FAR 52.203-13 for contracts (and subcontracts) for all acquisitions of a commercial item under FAR Part 12.
• Requirement for mandatory disclosure of violations of the civil FCA (31 U.S.C. 3729-3733) (in the clause, in the internal control system required by the clause, and as a cause for suspension or debarment).

Comments on the second proposed rule that do not relate to these three issues, unless presenting a new and pertinent perspective, have not been separately addressed in this preamble.

1. Interrelationship of Previous Final Rule, First Proposed Rule, Second Proposed Rule, and New Statute

a. Previous Final Rule, FAR Case 2006-007

The first proposed rule under FAR case 2007-006 (“first proposed rule”), proposed increases to the requirements introduced by final rule, FAR case 2006-007 (“previous final rule”), in the ways enumerated in the Background section above. Thirteen respondents remarked on the relationship to the previous final rule, some suggesting changes to the previous final rule as well as the first proposed rule.

i. Like the previous final rule under 2006-007.

• No further change needed. One respondent expressed the belief that the previous final rule is adequate to protect the Government's interest. Several other respondents supported the previous final rule's voluntary disclosure. One respondent questioned the need for the first proposed rule in light of the recent implementation of “more expansive contractor compliance standards in the FAR.”
• The first and second proposed rules enhance the previous rule. One Government agency explicitly supported the major provisions of both rules as sound business practices, highlighting their contribution to cost control as well as mission safety.

Response: No response necessary.

ii. Ethics code. With regard to the requirement for a code of conduct, one respondent considered that just having a code is meaningless. Several other respondents also objected to the requirement for a code of business ethics and conduct in the previous final rule under FAR case 2006-007, stating that existing contractor ethics standards work well and that these contractual requirements are redundant, add costs and other burdens, and are likely to generate additional uncertainties.

Several respondents objected to the outdated method of communicating the code, requiring a copy to each employee engaged in the contract. One respondent recommended that it may be more effective to refer employees to Web sites or provide tutorials in person, on-line, or through other means. This suggestion could minimize burdens through the use of information technology, as requested in the preamble to the proposed rule for this case.

Another respondent also objected that many institutions have more than a single code of conduct, each addressing different aspects of conduct that together cover all aspects of conduct that the FAR rule requires.

Response: The Councils do not agree that a code of conduct is meaningless. It can serve several related purposes. For a firm's business partners, including the Government, it provides a basis for evaluating the firm's responsibility, including special standards of responsibility when appropriate. It also provides a basis for internal policy development, for example human resources policies. And when something goes wrong, the code is meaningful for enforcement and for understanding and perhaps incorporating lessons learned.

While requiring establishment of a code will add costs and require effort on the part of entities that do not have them already, the Councils agree with several respondents that those resources are reasonable and justified to mitigate other and larger risks to the success and efficiency of Government projects. Because many entities already have made the investment, the rule will level the playing field in competitive environments.

The Councils agree that flexibility in the method of communicating the code to employees is appropriate, and the rule has been changed to require that it be made available to each employee engaged in performance of the contract. The Councils note that the rule does not preclude having multiple codes of conduct applicable to different segments of contractors' business lines.

iii. Training.

• Training requirement is too burdensome. One respondent was concerned that the requirements for training could take substantial time away from performing on their contracts to train staff on an unknown scope of Federal criminal law. The Government would incur costs from this activity through delays in the fulfillment of contracts and increased contractor expenses that will be passed along to customers.

Response: The Councils recognize that contract costs are reflected in prices, but do not consider schedules to be impacted by this requirement. By identifying the scope of violations of the Federal criminal law as those involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code, the Councils believe that the training requirements have been more clearly defined and the contractor's training requirement has been reduced.

• Require training on civil FCA. Several respondents proposed that Government contractors be required to educate their employees about the protections available under the civil FCA. The Department of Justice, Criminal Division (DoJ) suggested that contractors should also be required to include in their “business ethics awareness” obligation, reflected in the proposed rule at FAR 52.203-13(c)(2)(ii)(F), training on the civil FCA.

Response: The Councils do not agree that it is necessary under this case to dictate to contractors what they need to cover in business ethics training. If we highlight education on the civil FCA, or other specific areas, the contractors may place undue emphasis only on those areas mentioned in the regulations. The business ethics training courses may cover appropriate education on the civil FCA, as well as many other areas such as conflict of interest and procurement integrity and other areas determined to be appropriate by the contractor, considering the relevant risks and controls.

iv. Hotline posters. One respondent commented that the physical display of multiple hotline posters in common work areas is impractical and wasteful. Another respondent also objects to using hotline posters on the walls of the institution as being the most effective way of communication at every institution.

Response: The issue of multiple hotline posters was resolved under the final rule 2006-007. The requirement for hotline posters is outside the scope of this case.

b. Relationship of Second Proposed Rule to First Proposed Rule

One respondent questioned whether certain requirements of the first proposed rule that did not appear in the second proposed rule had been deleted.

Response: The preamble of the second proposed rule specified that it included only the sections of the rule affected by the three changes; it was only addressing three issues, not providing a completely revised proposed rule. Therefore, the fact that language in the first proposed rule that would not be affected by the 3 issues of concern was not repeated in the second proposed rule does not imply that that language was being deleted.

c. Relationship of Second Proposed Rule to New Statute

One respondent recommends that any disclosure requirement be limited to violations of the types specified in the “Closing the Contractor Fraud Loophole Act (Pub. L. 110-252, Title VI, Chapter 1)” (i.e., exclude violations of the civil FCA). This respondent also states that the statute does not require the disclosure to the OIG and the penalties of debarment/suspension are not required by the new statute, so should be eliminated.

Another respondent also makes the point that since the new law does not address disclosure of violations of the civil FCA, that requirement should not be included in the final rule under this case.

One respondent notes particularly that the new law does not require the “reasonable grounds to believe” standard, reporting to the Inspector General, or failure to report as an independent basis for suspension or debarment.

Response: This rule was initiated as a matter of policy. Although the new statute reinforces and provides a statutory basis for some aspects of the rule, the fact that any part of the rule is not required by statute does not alter the rationale that provided the underpinning for those aspects of the rule. Each aspect of the rule not required by statute must be considered on its own merits.

2. Mandatory Standards for Internal Control System

a. Minimum Requirements for the Internal Control System

One respondent considered that the previously recommended, now mandatory, internal control practices will be inadequate if they are considered to be maximum as well as minimum requirements. Another respondent considered the establishment of an internal control system that satisfies a laundry list of mandates will be overly burdensome. Another respondent would prefer that contractors be left free to choose to implement the USSG “in the prudent exercise of their business discretion,” rather than being required to do so. Likewise, another respondent stated that contractors may want to consider the USSG in designing compliance programs but, absent a statute or Executive order, they should not be made mandatory in the regulations.

Response: The rule does reflect minimum expectations. Competing firms are free to establish the highest ethical standards they consider to be appropriate to the business at hand. This case establishes a framework for institutional ethics management and disclosure and does not prescribe specific ethical requirements.

b. Relation of Rule to the USSG

i. Rule is consistent with the USSG. An agency OIG stated that the proposed rule should benefit Federal contractors. It provides guidance for contractors consistent with U.S. Sentencing Commission guidance on effective compliance and ethics programs for organizations. Compliance with the rule should assist contractors subject to the Sarbanes-Oxley Act of 2002 in fulfilling their responsibilities under the Act.

Response: None needed.

ii. USSG should be incorporated by reference. Several respondents commented that rather than using the ad hoc form of the USSG standards for compliance and ethics program, the actual USSG standards should simply be incorporated by reference. Conformity with the USSG will prevent contractors unknowingly failing to comply with all the USSG although complying with the FAR. Formal adoption of the USSG will create uniform criteria. A respondent recommended that all the descriptive paragraphs in (ii) be deleted, instead inserting: “The Contractor's internal control system shall provide for a compliance and ethics program that meets the standards of the Federal Organizational Sentencing Guidelines, as amended from time to time, United States Sentencing Commission Guidelines Manual: Sentencing of Organizations, section 8B2.1.

Response: These respondents would use the USSG Guidelines, in place of the FAR spelling out the required elements of internal control systems. However, the Councils prefer to spell out the elements. This lets the contractors know what is expected. The USSG are the source of the FAR text, but the FAR text is intentionally not adopting them verbatim. The procurement regulations are not the USSG; the contractor setting up an internal control system is in a different situation than a company accused of a crime. Some elements of the USSG are not appropriate for a procurement regulation. However, by making the minimum requirements generally consistent with the USSG, the Councils believe that a contractor should be in a better position if accused of a crime.

iii. Essential parts of the USSG are missing. One respondent commented that essential parts of the USSG are missing. One example is the reference to the use of an incentive system in compliance programs that encourages and rewards companies for implementing effective programs, following the model of the Organizational Sentencing Guidelines. The respondent recommends modifying 52.203-13(c)(1)(ii)(E) by inserting after “detect improper conduct” the words “and appropriate incentives to perform in accordance with the compliance and ethics program”.

Another example the respondent uses is the standard for effectively responding to violations, and taking steps to prevent recurrence. Without these, a company's program would not be considered effective under the USSG.

Response: The Councils note that the respondent must have intended to cite FAR 52.203-13(c)(2)(ii)(E). The Councils do not want to require incentives for employees within contractors' internal control systems. This is within companies' discretion. The mitigating factors for debarment (9.406-1(a)) already include consideration of remedial action (e.g., (6), (7), and (8)) taken by the contractor.

The FAR does cover responding to violations, and preventing recurrence, in FAR 52.203-13(c)(2)(i), and throughout (c)(2)(ii).

c. Principals

Several respondents asked for interpretation of the clause paragraph (c)(2)(ii)(B) requirement that the internal control system provide for reasonable efforts not to include within the organization principals whom due diligence would have exposed as having engaged in conduct that is illegal or otherwise in conflict with the Contractor's code of business ethics and conduct.”

• Is the “organization” the entire contractor, instead of the organization responsible for the code?
• Is the code retroactive to catch criminal behavior in the past?
• Is it only Federal crimes, or state and local as well?
• What about non-criminal behavior that did not violate the Contractor's code at the time?
• What kind of due diligence is necessary—a simple pre-employment questionnaire, or instead a costly background check with interviews of friends and neighbors?

Response:

• The Councils have revised the draft final rule (paragraphs (c)(2)(ii)(A), (B), and (C) of the clause 52.203-13) to eliminate use of the term “organization”. This term was a carryover from the USSG. This rule is addressed to the contractor—the entity that signed the contract, and subcontractors thereunder.
• The code of conduct is not itself retroactive. However, it is necessary to distinguish conduct of an employee during his/her employment, from past conduct uncovered during a background check of a prospective hire. That past conduct need not be disclosed to the Government, but should be part of the decision whether to hire the individual.
• Past criminal behavior of any type, even criminal behavior unrelated to contracting, calls into question whether the individual at the present time has integrity and is a proper role model for company staff. This is not a mandate to fire the individual, but to determine whether the individual is currently trustworthy to serve as a principal of the company.
• Behavior that was not criminal and did not violate a business's code as it existed at the time, is not the subject of this rule. In response to this comment, the Councils have revised paragraph (c)(2)(ii)(B) to delete the words “illegal or otherwise.” The term “illegal” is too broad and could include even a traffic violation. The Contractor's code of business ethics and conduct should cover the types of behavior that this requirement is intended to address.
• The level of background check required depends on the circumstances. This is a business decision, requiring judgment by the contractor.

The source of the FAR clause paragraph (c)(2)(ii)(B) is the USSG Manual paragraph 8B2.1.(b)(3). The Commentary on this paragraph includes this statement: “With respect to the hiring or promotion of principals, an organization shall consider the relatedness of the individual's illegal activities and other misconduct (i.e., other conduct inconsistent with an effective compliance and ethics program) to the specific responsibilities the individual is anticipated to be assigned and other factors such as: (i) the recency of the individual's illegal activities and other misconduct; and (ii) whether the individual has engaged in other such illegal activities and other such misconduct.”

d. Periodic Review

One respondent asked for an interpretation of the clause paragraph (c)(2)(ii)(C) requirement for periodic review of business practices. For “monitoring and auditing”, is standard business practice and generally acceptable accounting principals sufficient? What system for assessing the “risk of criminal conduct” would be sufficient? Is there a Government program that is an acceptable process?

Response: Standard business practice for “monitoring and auditing to detect criminal conduct” which conforms to generally accepted accounting principles should be sufficient. The “monitoring and auditing” is amplification of the current FAR requirement for periodic review and auditing, from the FAR case 2006-007 published in November 2007.

One respondent stated that annual audits of research processes may already review compliance with policies for ethical conduct of research funded under Federal contracts. The FAR can acknowledge, through an Alternate to the clause, that duplication of review is not required where reviews under other rules already cover the necessary subjects.

Response: The FAR is not requiring wasted duplication of effort. No change to the regulation is necessary.

3. Mandatory Disclosure to the OIG

Of the 43 respondents that commented on the first proposed rule, 36 commented specifically on sub-paragraph (b)(3) of the clause 52.203-13, Contractor Code of Business Ethics and Conduct, which requires mandatory disclosure, in writing, to the agency OIG, with a copy to the contracting officer, whenever the contractor has reasonable grounds to believe that a principal, employee, agent, or subcontractor of the contractor has committed a violation of Federal criminal law in connection with the award or performance of the contract or any subcontract thereunder.

Six agency OIGs, as well as several Government agencies all specifically concurred with the mandatory disclosure of violations by contractors.

Other respondents, including agency OIGs, while concurring with mandatory disclosure, suggested improvements in the way this requirement is implemented in the rule.

The other 17 respondents that commented specifically on the mandatory disclosure disagreed with this approach and recommended voluntary disclosure.

a. Need for Mandatory Disclosure

Note that the following comments in this section all preceded the enactment of the statute that requires mandatory disclosure, so that the issues are now primarily moot.

i. Major departure from long-standing policy. One respondent stated that this rule is a major departure from long-standing and proven Federal policies that encourage voluntary disclosures. Likewise, another respondent stated that mandatory disclosure runs counter to many established Government processes. One respondent considered the proposed regulation to be a “sea change” in the fundamental approach to compliance followed by the Government. Another respondent noted that in 1986 a proposal from DoD to make fraud disclosures mandatory foundered on “state action” grounds. In 1988, then Secretary of Defense Richard Cheney withdrew a proposed rule that would have governed such programs on the grounds that “to be meaningful, corporate codes of conduct must be adopted by contractors voluntarily, not mandated in procurement regulations (54 FR 30911)”. Another respondent also cited a 1996 GAO report on the DoD Voluntary Disclosure Program (GAO/NSIAD-96-21) in which the GAO quotes the DoJ as praising the DoD Voluntary Disclosure Program.

Several respondents cited the DFARS regulations as being a model for voluntary disclosure. Several other respondents stated that many Federal agencies that have considered mandatory disclosure rules have declined to adopt them in favor of voluntary disclosure programs (e.g., Department of Health and Human Services in 2000 (65 FR 40170) and in 2004 (69 FR 46866)).

Response: There is no doubt that mandatory disclosure is a “sea change” and “major departure” from voluntary disclosure, but DoJ and the OIGs point out that the policy of voluntary disclosure has been largely ignored by contractors for the past 10 years. In addition, in that same time period mandatory disclosure has been adopted for banks and public companies and stressed by the U.S. Sentencing Commission and DoJ, as further discussed in the following sections.

ii. Is voluntary disclosure working? Various respondents stated that the proposed rule fails to demonstrate that there is a need for change based on failure of voluntary disclosure. According to these respondents, neither DoJ nor the Councils have cited data supporting the claim that voluntary disclosure is not effective. One respondent stated that a purported paucity of participants in the DoD IG Voluntary Disclosure Program does not establish a decline in contractor disclosures to the Government sufficient to justify a mandatory disclosure requirement. Another respondent stated that DoJ is comparing the last few years to data from 20 years ago. One respondent cited disclosures for FY 2005-2007 that are relatively level. Another respondent cited the December 2006 issue of Corporate Counsel that voluntary disclosures are increasing rather than decreasing, citing Mr. Mark Mendelssohn of DoJ and a recent report by Sherman & Sterling. Even if there is a decline in disclosure under the DoD Voluntary Disclosure Program, another respondent found that the leap to mandatory disclosure “gives rise to a perverse implication that justification for mandating regulations can be asserted simply because no one has shown that the activity to be regulated is not happening.”

One respondent stated that the assumptions about the reason for the decrease are misplaced. Another respondent firmly believed that there is need for analysis of the reasons for any decline in voluntary disclosures. Even if mandatory disclosures to the DoD IG Voluntary Disclosure Program are decreasing, several respondents suggested the following possible explanations:

• Less emphasis by DoD.
• Fewer reportable violations.
• More instances resolved as contract matters, with reports to contracting officers or heads of contracting activities or to audit agencies like DCAA and DCMA.
• Perception that the Government is slow in processing voluntary disclosures.
• Lack of restrictions on use of disclosure reports in criminal or civil actions or in administrative actions against individuals.

One respondent elaborated that there may be fewer voluntary disclosures because self-governance is working to prevent and detect contract formation and contract performance issues before they result in criminality or civil fraud. Reduction in the rate of voluntary disclosures would be an expected byproduct of improved internal processes, enhanced training, better internal controls, and an improved culture of ethics and compliance.

One respondent stated that a number of companies have commented that delays in processing disclosures to the OIG are a significant factor in their decision to report problems to the contracting officer instead of to the DoD Voluntary Disclosure Program.

One respondent suggested other avenues for disclosure that are more relevant to the kinds of illegal activity being found these days, such as—

• The DoJ Antitrust Division. Voluntary disclosures to DoJ have increased as disclosures to the DoD IG program have decreased (see http://www/​usdoj.gov/​atr/​public/​speeches/​232716.htm#N_​1_​);
• The Department of State Directorate of Defense Trade Controls. This program has been very successful at inducing voluntary disclosures (see GAO-05-234 (Feb 2005)); and
• Foreign Corrupt Practices Act. Enforcement actions for violations of the FCPA have also grown, again largely due to voluntary disclosures made by corporations (see “U.S. Targets Bribery Overseas Globalization; Reforms Give Rise to Spike in Prosecutions,” The Washington Post (Dec 5, 2007)).

One respondent suggested that mandatory reporting should be replaced with a strong voluntary disclosure program modeled after the DoJ Antitrust Division's Corporate Leniency Programs.

Another respondent noted that it is DoJ, not DoD, that apparently believed that the mandatory disclosure provisions were necessary. This respondent interpreted this to mean that DoD is satisfied with the number and types of disclosures being made.

One respondent stated that DoJ should be required to demonstrate that there is an upward trend of criminal prosecutions of the top 100 Government contractors where it was established that contractor principals were aware of violations of the law and made a conscious decision not to disclose those violations to the Government. Similarly, another respondent suggested that DoJ should offer factual support for its thesis that crimes are occurring and being found and yet not being reported voluntarily. One respondent also wanted DoJ to explain why other less burdensome changes, such as improving the existing voluntary disclosure programs, cannot be used to achieve the desired result.

On the other hand, in the DoJ letter of May 23, 2007, DoJ stated that its experience suggests that few corporations have actually responded to the invitation of DoD that they report or voluntarily disclose suspected instances of fraud. An agency OIG stated that the vast majority of crimes involving contractors that it investigates are not reported by the contractor. Another agency OIG stated that Government contractors are coming forward significantly less frequently with voluntary disclosures. It considered that this mandatory requirement may be the most effective way for the Government to monitor its vendors.

Response: In the DoJ letter dated May 23, 2007, which requested the Administrator of the Office of Federal Procurement Policy, Mr. Paul Denett, to open this case, DoJ states that its experience suggests that few companies have actually responded to the invitation of DoD to report or voluntarily disclose suspected instance of fraud. The respondents do not dispute that relatively few contractors are using the DoD Voluntary Disclosure Program. The contractor groups, in their public comments on the rule, implicitly concede that the Voluntary Disclosure program is not being used and blame DoJ and the OIG. Some claim that informal disclosures are being made to the contracting officers but offer no specific evidence.

Even if it is true that there are comparatively fewer violations now than 20 years ago or that some situations are resolved administratively, there are still significant numbers of violations occurring and being prosecuted that have not been self-disclosed.

Importantly, the incentive to self-disclose Antitrust violations is not applicable. Antitrust deals with the Sherman Act and the Clayton Act, which prohibit conspiracy in restraint of interstate or foreign trade and regulate practices that may be potentially detrimental to competition (price discrimination, exclusive dealing contracts, etc.). Under the Antitrust Division's Corporate Leniency Program, the first company that reports the violation receives immunity from prosecution. That type of circumstance does not apply here.

iii. Existing legal requirements and regulations as models for the rule.

In the DoJ letter of May 23, 2007, DoJ stated that—

• Unlike healthcare providers or financial institutions, there is at present no general requirement that contractors alert the Government immediately as a matter of routine when fraud is discovered;
• DoJ has been careful not to ask contractors to do anything that is not already expected of their counterparts in other industries;
• Our Government's expectations of its contractors has not kept pace with the reforms in self-governance in industries such as banking, securities, and healthcare. Several respondents all considered that for far too long contractors have played by different rules than their counterparts in other industries, such as health care providers and research grant recipients. A Government agency commented that healthcare providers and banks have had such a requirement for many years. An agency OIG commented that in the past 15 years there have been significant reforms in industries such as banking, securities, and healthcare, yet we have not asked the same of Government contractors.

In the DoJ letter of May 23, 2007, DoJ stated that the requested changes are modeled on existing requirements found in other areas of corporate compliance such as the Sarbanes-Oxley Act of 2002 and expand slightly on the Contractor Standards of Conduct in DFARS 203.7000. DoJ also noted that the National Reconnaissance Office (NRO) has begun requiring its contractors to disclose contract fraud and other illegal activities.

a. More far-reaching. However, one respondent stated that the proposed rule imposes substantially more far-reaching and draconian disclosure obligations on Government contractors than those presently made applicable to financial institutions by submission of Suspicious Activity Reports (12 CFR 21.11). The financial institution has to report a crime if the financial institution is an actual or potential victim of the criminal activity. Where a contractor is a victim of a crime committed by an employee or another person, the employee's conduct is not imputed to the contractor. Therefore, the corporation does not incur the risk of criminal liability when it reports an employee violation and is not incriminating itself.

According to another respondent, the current laws and regulations are not sweeping and burdensome, but are specific and narrowly focused. The respondent pointed out that the Anti-Kickback Act and Foreign Corrupt Practices Act limit their mandatory disclosure to a very limited class of activity. The respondent also pointed out that Sarbanes-Oxley contemplates internal reporting mechanisms and review mechanisms at the highest levels before any reporting occurs. The other respondent also addressed the internal control certification required by the Sarbanes-Oxley Act of 2002. Sarbanes-Oxley applies to a contractor that is a public company. Section 302 of Sarbanes-Oxley does not require that a public company disclose to the Government conduct it believes may be a violation of criminal law.

Response: Many of the public comments reveal a basic misunderstanding of the existing mandatory disclosure requirements found in the healthcare, banking, and securities areas. Each requirement effectively mandates disclosure of fraud as broad as the particular regulatory issue being addressed can reach. Beyond that limitation, these other requirements are no more limited than the proposed rule, particularly with the further changes in the final rule with regard to the types of Federal crimes covered.

In particular, the Councils do not agree with the interpretation of 12 CFR 21.11. 12 CFR 21.11 requires financial institutions to report suspicious activities committed or attempted against the bank or involving a transaction or transactions conducted through the bank, where the bank was used to facilitate a criminal transaction.

Even though Section 302 of Sarbanes-Oxley does not require a public company to disclose to the Government conduct it believes may be a violation of criminal law, there are pre-existing securities laws and regulations that require disclosure to the SEC. Sarbanes-Oxley does not provide immunity from prosecution for wrong-doing but provides protection against third-party liability with regard to a lawsuit by the persons accused of wrongdoing.

b. Conforming the FAR? One respondent stated that if the FAR Council is relying on conforming the FAR to regulations applicable to other industries as a justification, the Council should state this explicitly and provide a detailed analysis of the regulations in other areas on which it is relying.

Response: The Councils did not rely on conforming the FAR to regulations applicable to other industries as a justification, but merely cited some parallels. The FAR regulations are designed to suit the particular circumstances of acquisition.

c. Particular public need/statutory basis? One respondent stated that current disclosure programs are not instructive. The respondent also stated that these programs are targeted towards a particular public need, and in most cases are the product of legislation that was enacted in response to a particular public scandal or important national need. In enacting statutory schemes, Congress saw a particular need and targeted legislation to address the particular need (Sarbanes-Oxley, the Anti-Kickback Act, the Foreign Corrupt Practices Act, and banking laws).

Several respondents were concerned that the same justification does not exist for this proposed rule as the cited statutes and regulations. One respondent stated that the Council has not provided a rational basis to explain why such a significant change to the FAR is necessary. The respondent asserted that the proposed rule could be challenged under the Administrative Procedure Act (APA) because the FAR Council has not provided a “rational basis” to justify the mandatory disclosure requirement, nor is there statutory authority behind the FAR Council to issue a regulation providing for mandatory disclosure of criminal acts. The respondent therefore concluded that the FAR Council lacks the authority to issue the regulation (See AFL/CIO v. Kahn, 472 F. Supp. 99 (D.D.C. 1979), rev'd, 618 F. 2d 784 (D.C.Cir. 1979)). One respondent saw this as particularly important in light of DoJ's reliance upon the example of other statutorily-mandated disclosure programs (Sarbanes-Oxley, Foreign Corrupt Practices Act, etc.) as justification for this regulatory initiative. The respondent stated that the mandatory disclosure provisions in the proposed rule are neither the product of specific findings or legislation, nor any perceived critical national need, and thus are not appropriately compared to other existing mandatory disclosure programs.

Response: The DoJ proposed a mandatory disclosure program in order to emphasize the critical importance of integrity in contracting. The public demands honesty and integrity in corporations with which the Government does business. If there is concern that there is not a current public need warranting proceeding with this case, the Councils cite the public outcry over the overseas exemption in the first proposed rule and the recent enactment of the Close the Contractor Fraud Loophole Act (Pub. L. 110-252, Title VI, Chapter 1). The Act requires exactly what the first rule proposed, except that the overseas and commercial item exemptions have been eliminated. However, the rule did not require this legislation in order to have the authority to proceed in this case. The Councils issue rules under the authority of the Office of Federal Procurement Policy Act as well as 40 U.S.C. 121(c), 10 U.S.C. chapter 137, and 42 U.S.C. 2473(c). The Administrator for Federal Procurement Policy may prescribe Governmentwide procurement policies to be implemented in the FAR (41 U.S.C. 405). This case was opened at the request of OFPP. This case is making clear what was already expected. It is not unreasonable or “capricious” to require contractors doing business with the Government to disclose violations of the civil False Claims Act (civil FCA) or a violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code that have occurred in connection with the award, performance, or closeout of any Government contract performed by the contractor or a subcontract thereunder. Existing DoJ guidelines addressing corporate prosecution standards, while certainly not providing amnesty, suggest that if a company discloses such violations, the prosecution will be of the individuals responsible for the violation, not the entire organization.

d. Empirical support that mandatory disclosure will achieve the Councils' objective. One respondent stated that mandating disclosure without empirical support to show that it will achieve the Councils' objectives will be susceptible to challenge. The APA requires courts to strike down rules devoid of factual support. Another respondent also cited the APA, and that a rule may be set aside if it is arbitrary or capricious (5 U.S.C. 706).

Response: The Councils point to the testimony from DoJ and various OIGs that the experience with the NRO mandatory disclosure clause has been positive (see next paragraph). The Councils further cite the enactment of the Close the Contractor Fraud Loophole Act (see prior section), which now mandates many of these revisions to the FAR.

e. The NRO requirement. An agency OIG noted that similar contractually imposed disclosure requirements have been successfully implemented by the NRO. According to DoJ, the NRO reports that this requirement has improved its relationships with its contractors and enhanced its ability to prevent and detect procurement fraud. Another agency OIG stated that adoption of the NRO clause resulted in increased and earlier disclosure of wrongdoing and better working relationships built upon greater sharing of information and trust. It also led to the conclusion that it is more effective for a contractor to mandatorily disclose information pursuant to a requirement, than it is for a contractor to be in a position of offering up information that it could be criticized, or even sued, for providing.

One respondent, however, stated that the NRO requirement is not an appropriate model for all Government contractors because it requires disclosure of potential illegal activity related to the conduct of intelligence operations in the interest of national security and thus is not instructive. In fact, according to another respondent, the unique nature of the NRO and its responsibilities are major reasons cited as justification for its disclosure program. Similarly, the other respondent stated that, while the NRO's mandatory disclosure program was not the product of legislation, it was the direct product of an obvious and public awareness that we live in a different world after September 11, 2001.

Furthermore, several respondents cited problems with the NRO disclosure program. One respondent stated that “it is far from clear at this point whether the NRO mandatory disclosure program is or will be productive”, citing anecdotal reports from the contractor community suggesting that the program is not as effective as the NRO claims. One respondent cited problems experienced by contractors subject to the NRO OIG reporting clause, claiming that the NRO OIG has inserted itself in the administration of contracts by using the clause as the basis to become involved in all aspects of the contractor ethics functions and corporate investigations. For example, the respondent stated that the OIG has used this clause to investigate, as a Federal offense, matters as mundane as employees who have been disciplined for leaving work early while reporting they were present. The respondent does not believe that OIG agents should be routinely involved in company internal ethics functions and contract administration. The respondent quoted Mr. Paul Denett, Administrator of the Office of Federal Procurement Policy: “The IG serves a purpose, but it needs to be limited to core areas.”

However, the response from the National Procurement Fraud Task Force (NPFTF), signed by the IG of the NRO, stated that the requirement for mandatory reporting has worked very well at NRO: The reporting of wrongdoing has increased, comes earlier, and has led to a good working relationship. NPFTF considers that this model can have a similar impact across the Federal Government, and that the situation at NRO is not unique.

Response: Almost all the agency OIGs submitting public comments cite the success of the clause initiated by the NRO OIG as a reason for supporting this rule for their agency procurements.

As to limiting the role of the OIG to its core area, the core area of the OIG is to investigate fraud, conflict of interest, bribery, and gratuity violations. OIG agents will not be routinely involved in company internal ethics functions and contract administration unless violations are disclosed. The final rule has been revised to more closely focus the situations that must be disclosed by limiting violations of criminal law to violations involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code (see B.3.b.iii.).

iv. Will mandatory disclosure make reporting easier or better? In the DoJ letter of May 23, 2007, DoJ stated that if the FAR were more explicit in requiring such notification, it would serve to emphasize the critical importance of integrity in contracting. An agency OIG stated that the requirement will simplify the contractors' decision on whether to disclose suspected violations. Likewise, another agency OIG stated that the contractor is in a stronger position when reporting for the purpose of complying with a mandatory requirement than if voluntarily disclosing information, for which it could be criticized, or even sued. Another agency OIG commented that making self-reporting a requirement gives the honest contractor employees necessary leverage over those who may seek to shield the employer when wrongdoing is noticed or suspected.

On the other hand, some other respondents believed that if employees know that everything they report will be passed on to the Government, this may result in less reporting up the chain of the company rather than more. One respondent saw substantial potential to decrease rather than enhance cooperation with company compliance efforts.

The respondent was concerned that the likelihood of severe consequences will necessarily change the relationship of the company and its employees. Every interview will have the potential of resulting in employees being reported. It may be that investigative targets may not only be entitled to counsel, but to Miranda warnings, if the company is deemed to be acting on behalf of the Government. Further, another respondent was concerned that mandatory reporting may violate existing contracts with a labor union and may be an unfair labor practice if imposed without bargaining, citing American Elec. Power Co., 302 NLRB 161(1991). Resistance by the employees can undercut the entire compliance program. A respondent also believed that employees may be reluctant to come forward if they are aware that the contractor will be required to report their co-workers, or report the company itself, to the OIG. This respondent cited studies by the framers of the USSG who undertook significant research addressing these issues.

Response: The Councils believe that by mandating disclosure, contractor executives and their counsel will be more inclined to make the required disclosure to the OIG, as opposed to either not disclosing or informally alerting the contracting officer, who is not in a position to evaluate the criminal behavior of individual employees. By mandating disclosure to the OIG, the rule will add weight to the arguments inside a corporation that good business practices in the long run favor compliance and disclosure. Nothing in the proposed rule requires administration of “Miranda” warnings. The rule does not place contractors in the role of law enforcement officers. With regard to the concerns about labor agreements, contractors can find ways to disclose without violating labor union provisions that protect individual privacy of workers.

v. Cooperative atmosphere more effective. According to one respondent, voluntary disclosure fosters a cooperative environment and rewards contractors that adopt effective internal controls. Another respondent considered that it is a key principle to promote self-governance as the preferred model to ensure compliance. This respondent quoted the Packard Commission findings in June 1986 that self-governance is the most promising mechanism to foster improved contract compliance. Self-governance makes the difference between responsibility for compliance and a mere facade of compliance. This respondent concluded that, based on 20 years of experience, both scholars and industry leaders believe that the current system of voluntary disclosure encourages companies to develop a stronger culture while still affording the Government broad remedies to protect the Government's interests. Under mandatory disclosure, contractors may focus on the ambiguities of the letter of the rule rather than the spirit of mutual commitment. One respondent expressed long standing support for and experience with voluntary self-reporting. It is concerned that mandatory self-reporting could discourage partnerships with the Government. One respondent cited the “fundamental principle” that contractor compliance programs resulting from internal company commitments to ethical behavior are more likely to be effective in preventing illegal behavior than programs imposed by “overbearing regulations.”

Response: The Councils disagree. See “Is voluntary disclosure working?” at paragraph B.3.a.ii.

vi. Incentives. Several respondents contended that existing Government programs and contractor initiatives offer ample incentives for contractors to voluntarily report procurement violations.

• Several respondents pointed out that contractors may receive favorable consideration in debarment proceedings if they have voluntarily disclosed the conduct in question.
• Several respondents cited the civil FCA, which provides contractors with an incentive to report potentially fraudulent behavior. Organizations will voluntarily disclose to avoid lengthy and costly whistleblower litigation (qui tam actions). According to several respondents, voluntary disclosure can undermine a court's jurisdiction to entertain future qui tam cases and can mean the difference between maximum and reduced penalties.
• Several respondents also addressed the reduced penalties under the guidelines of the USSG, adopted in 1991, which are predicated on a model of rewarding voluntary reports. Two respondents stated that the proposed rule is inconsistent with the favorable treatment of voluntary disclosures under the USSG.
• Respondents cited the Deputy Attorney General's January 20, 2003, memorandum, “Principles of Federal Prosecution of Business Organizations,” which provides to Federal prosecutors guidance governing charging decisions with respect to corporations and sentencing. Several respondents also cited Deputy Attorney General Paul J. McNulty's memorandum of December 12, 2006, which demonstrated that the DoJ considers an organization's voluntary disclosure and cooperation in determining whether to bring charges.

Various respondents were concerned that the proposed rule may eliminate the ability of a contractor to claim the benefit of “timely and voluntary disclosure” to the Government. One respondent recommended that, if the rule is finalized, a contractor should not be precluded from seeking and receiving leniency because a disclosure is made in compliance with the rule. One respondent stated that the proposed rule is not more consistent with the USSG, but actually contradicts them.

One respondent stated that the Councils must consider these concerns and evaluate the extent to which eliminating incentives to voluntary disclosure will affect a contractor's decision to disclose underlying behavior. The respondent believed that eliminating incentives could cause contractors to adopt a protective posture in the face of evidence of potential criminal behavior.

Another respondent suggested that, instead of mandating compliance and ethics programs, the Councils should open a new FAR case to develop an incentive-based approach. This respondent was concerned that the logic of penalizing contractors for failure to disclose a crime, rather than offering incentives, will not work. The disclosure obligation applies only if a crime has already occurred. If there is already a crime, then the company is already subject to punishment. Failure to disclose will only be an aggravating factor. So, if a company fails to disclose, it may escape punishment, but if it discloses, it will likely still be subject to punishment for the crime committed. Therefore, punishment for failure to disclose may not be sufficient incentive to disclose.

Response: There is nothing in this rule that removes any of the existing incentives. The incentives in the FAR (FAR 9.406-1(a)) and the USSG are not limited to “voluntary” disclosures but to “disclosures.” Even if disclosure is “mandatory,” incentives will still be offered to promote compliance.

b. Vagueness of Rule

i. “Reasonable grounds to believe.” Numerous respondents were concerned that the rule does not specify what constitutes “reasonable grounds.” One respondent stated that “reasonable grounds” is subject to varying interpretations, and may be viewed as an even lower standard than “probable cause.” Should the contractor report based on mere suspicion or based on evidence that criminal activity has occurred? Because of this lack of clarity, several respondents were concerned that companies may tie up Government resources with a mountain of meaningless legal trivia. Numerous respondents stated that there will be substantial over-reporting because contractors may report even remotely possible criminal conduct out of an abundance of caution. One respondent considered that this will raise company costs through the investigation of baseless claims and incidents. Several other respondents stated that there will be an enormous amount of time spent sorting out the true criminal activity and truly significant problems.

One respondent suggested that the proposed rule will potentially subject an employer to civil actions brought by an employee when the reports forwarded by the employer to the Federal Government (because conceivably “reasonable grounds” existed) ultimately are determined to lack merit.

Response: The Councils have replaced “reasonable grounds to believe” with “credible evidence.” DoJ Criminal Division recommended use of this standard after discussions with industry representatives. This term indicates a higher standard, implying that the contractor will have the opportunity to take some time for preliminary examination of the evidence to determine its credibility before deciding to disclose to the Government. See also the following discussion of “timely disclosure.”

ii. Timely disclosure.

There are 3 aspects of timely disclosure that are of concern to the respondents:

• To which violations/contracts does timely disclosure apply?
• How much time does a contractor have to disclose a possible violation after first hearing something about it?
• How do we transition into this rule? How is timeliness measured for violations that the contractor may already know about and did not disclose prior to becoming subject to this rule?

Further, in analyzing these issues, there are 3 separate requirements for timely disclosure in this rule which may affect the response to the above questions:

• The contract clause requirement to disclose (paragraph (b)(3)).
• The contract clause requirement for an internal control system (paragraph (c)(2)(ii)(F)).
• Failure to timely disclose as a cause for suspension/debarment regardless of requirement for contract clause or internal control system (Subpart 9.4).

a. To which violations/contracts does timely disclosure apply?

Various respondents were concerned about whether the rule can apply to violations that occurred before the effective date of the rule, the date of the bid, or the date the clause is incorporated into the contract.

• Effective date of the rule. Numerous respondents recommended that the rule be made applicable only to conduct occurring on or after the date the rule is effective. The respondents argued that there is presently no requirement in the FAR for a contractor to disclose to the Government criminal violations committed by its employees. The respondents cited case law to support the argument that application of the rule to conduct occurring before the rule effective date would be impermissible. One respondent stated that the reporting requirement should be “prospective only”. Otherwise this requirement may impose an unreasonable burden.
• Date the clause is incorporated. Another respondent questions whether the rule is meant to cover past acts, or only acts going forward from the date the clause is incorporated into a contract. According to one respondent, to punish entities for past acts would violate constitutional ex post facto prohibitions.
• Date of the bid. One respondent suggested that the violation would have to occur after the date of the bid.

Several respondents also looked at the end of the period during which violations that occur must be reported. One respondent suggested that completion of performance would be appropriate.

DoJ suggested limiting the mandatory disclosure of overpayments or criminal violations to matters discovered by the contractor within three years after contract completion.

Response: The first significant point to remember is that in all cases the reportable violations are linked to the performance of Government contracts. In the case of the contract clause direct requirement for contractor disclosure, the reportable violations are limited to the contract containing the clause. So the questions raised by the respondents about occurrence of violations are not an issue with regard to the contract clause disclosure requirement, because violations would necessarily occur during award or performance of the contract, through contract closeout, which would necessarily be after the effective date of the rule and after incorporation of the clause. (Note: The clause will be included in solicitations and resultant contracts after the effective date of the rule, in accordance with FAR 1.108(d)).

However, in the case of internal control systems and suspension/debarment, the proposed rule states that reportable violations could occur in connection with “any Government contract.” This could be overly broad in two regards—

• Does it apply to violations on the contracts of other contractors?
• Does it apply to contracts closed out 20 years ago?

The Councils have made clear in the final rule that this disclosure requirement is limited to contracts awarded to the contractor (or subcontracts thereunder). It was not the intent of the proposed rule to require contractors to report on violations of other contractors under contracts unrelated to their own contracts.

The Councils do not agree with the respondents who think that disclosure under the internal control system or as a potential cause for suspension/debarment should only apply to conduct occurring after the date the rule is effective or the clause is included in the contract, or the internal control system is established. The laws against these violations were already in place before the rule became effective or any of these other occurrences. This rule is not establishing a new rule against theft or embezzlement and making it retroactive. The only thing that was not in place was the requirement to disclose the violation. If violations relating to an ongoing contract occurred prior to the effective date of the rule, then the contractor must disclose such violations, whether or not the clause is in the contract and whether or not an internal control system is in place, because of the cause for suspension and debarment in Subpart 9.4.

However, the Councils agree that this requirement should not stretch back indefinitely into the past (e.g., contracts that were closed 20 years ago). At that point, relevance with regard to present responsibility has diminished, there is less availability of evidence to support an investigation, there is more difficulty locating the responsible parties (who is the contracting officer?), and there should be some reasonable limitation on a contractor's liability after contract closeout.

The Councils considered using contract closeout as the end point for the requirement to disclose fraud, but according to the DoJ, often contract fraud occurs at the time of closeout, and cutting off the obligation to disclose at that point would exempt many of these violations from the obligation to disclose. Three years after final payment is consistent with most of the contractor record retention requirements (see Audit and Records clauses at FAR 52.214-26 and 52.215-2). Therefore, the Councils concur with the DoJ recommendation that the mandatory disclosure of violations should be limited to a period of three years after contract completion, using final payment as the event to mark contract completion.

Therefore, the Councils have added the phrase “Until 3 years after final payment on any Government contract awarded to the contractor” at 9.406-2(b)(1)(vi) and 9.407-2(a)(8), and has added in the clause at paragraph (c)(2)(ii)(F) the statement that “The disclosure requirement for an individual contract continues until at least 3 years after final payment on the contract.” To make the applicability during the close-out phase of a contract clearer, the Councils have revised the draft final rule in all applicable places to refer to “award, performance, or closeout.”

b. Does “timely” allow sufficient time between first learning of the allegation and the disclosure?

One respondent objected that “timely” is very broad in scope which could permit contracting officers to have inconsistent interpretations of what is timely. One respondent questioned whether “timely” means upon first learning of an allegation or only upon conducting an adequate internal investigation. The respondent recommended that the regulations should include a set period of time (i.e., 90 days) for any reporting requirement. Another respondent recommended that the regulations might allow 60 days to determine if there are reasonable grounds to conclude that the contractor committed a crime. The 60 day period would start when a principal of the company suspects that a crime might have been committed, but lacks reasonable grounds for concluding that a crime has been committed. An agency OIG suggested “timely” should be replaced with “within 30 calendar days.”

Another respondent was concerned that when “timely” disclosure must occur is ambiguous because the timing of a violation is troublesome. Contractors often settle cases without any admission of fault or liability. The rise in deferred and non-prosecution agreements in criminal cases brought by the Government against contractors creates confusion regarding disclosure of criminal violations.

According to many respondents, the proposed rule may require premature reporting. One respondent questioned the requirement to notify without delay, whenever the contractor becomes “aware” of violations of Federal criminal law. According to this respondent, the rule does not clarify what constitutes “awareness.” Several other respondents were concerned that the proposed amendment does not appear to allow a contractor to complete an internal investigation before notifying the OIG and contracting officer. Several respondents considered that an internal investigation could be compromised by premature reporting. One respondent recommended that the rule should allow the contractor the opportunity to comply with its ethics and compliance program and conduct an internal investigation prior to disclosure to the Government. Contractors should be required to report only actual violations of law, not those incidents that have not been confirmed as actual violations.

One respondent pointed out that existing voluntary disclosure protocols allow for internal investigation by the reporting parties before a disclosure is made. Another respondent stated that under the DoD Voluntary Disclosure Program, if the preliminary investigation reveals evidence to suggest that disclosure is warranted, contractors may disclose information sufficient for preliminary acceptance into the DoD Voluntary Disclosure Program, and then have 60 days to complete a fuller investigation. This rule provides no guidance on preliminary steps afforded to a contractor.

One respondent also recommended that the contractor be explicitly provided with a reasonable period of time to internally investigate a potential violation.

DoJ suggested that the preamble to the final rule should make clear that nothing in the rule is intended to preclude a contractor from continuing to investigate after making its initial disclosure to the Government. DoJ would expect that the OIG or the contracting officer will encourage the contractor to complete its internal investigation and make full report of its findings.

In their comment on the second proposed rule, one respondent recommends that the preamble should explain that a contractor, with the contracting officer's approval, may tailor the “timely reporting” provision of its internal control system in order to make meaningful reports to the contracting officer.

Response: First, the Councils note that the new statute uses the term “timely” in setting forth disclosure requirements. The Councils considered, and rejected, adding a set period of time, e.g., 30 days, to the disclosure requirement. It was decided that doing so would be arbitrary and would cause more problems than it would resolve, e.g., how to determine when the 30 days begins.

Further, the Councils believe that using the standard of “credible evidence” rather than “reasonable grounds to believe” will help clarify “timely” because it implies that the contractor will have the opportunity to take some time for preliminary examination of the evidence to determine its credibility before deciding to disclose to the Government. Until the contractor has determined the evidence to be credible, there can be no “knowing failure to timely disclose.” This does not impose upon the contractor an obligation to carry out a complex investigation, but only to take reasonable steps that the contractor considers sufficient to determine that the evidence is credible.

The Councils note that there is no rigidness to our proposed requirement to establish an internal control system. The rule just sets forth minimum requirements. The contractor can use its own judgment in the details of setting up a system that meets the minimum requirements. The clause does not require contracting officer approval of this system.

c. Transitioning into the rule. Meaning of “timely” when the knowledge of credible evidence pre-dates the requirements of this rule. One respondent stated that the reporting requirement should be “prospective only”. Otherwise this requirement may impose an unreasonable burden.

Response: As just discussed, the disclosure requirement is prospective only. Although violations on the current contract might have occurred during the pre-award phase and violations on other contracts may have already occurred prior to establishment of the internal control system or prior to the effective date of the rule, timely disclosure of the violation can only be measured from the time when the requirement to disclose the violation came into effect, even if credible evidence of the violation was previously known to the contractor.

With regard to the contractual disclosure requirement, the timely disclosure would be measured from the date of determination of credible evidence or the date of contract award, whichever event occurs later.

With regard to the disclosure requirement of the internal control system, it can only become effective upon establishment of the internal control system. The violation can have occurred with regard to any Government contract which is still open or for which final payment was made within the last 3 years, so may predate establishment of the internal control system. Therefore, timely disclosure of credible evidence as required by the internal control system would be measured from the date of determination by the contractor that the evidence is credible, or the date of establishment of the internal control system, whichever event occurs later.

With regard to the knowing failure by a principal to timely disclose credible evidence of a violation or significant overpayments as a cause for suspension or debarment, the violation can have occurred with regard to any Government contract, which is still open or for which final payment was made within the last 3 years, so may predate the effective date of the rule. Therefore, timely disclosure of credible evidence as required by the rule as a cause for suspension or debarment would be measured from the date of determination by the contractor that the evidence is credible, or from the effective date of the rule, whichever event occurs later.

To some extent, the effective date of the rule actually trumps the other events, because the failure to timely disclose as a cause for suspension/debarment is independent of the inclusion of the contract clause in the contract or the establishment of an internal control system. At least in those instances where disclosure was not timely in regard to effective date of the rule, but was reported as soon as the clause was in the contract, or as soon as the control system was in place, then it would not be a violation of the contract or a mark against the control system. It could still be a cause for suspension or debarment, although the Councils consider that suspension or debarment would be unlikely, if the contractor came forward as soon as the clause or the internal control system was in place (before that, the contractor might have been unaware of the requirement to disclose).

iii. “Criminal violation in connection with contract award or performance.” Numerous respondents stated that the rule fails to specify what constitutes a “criminal violation” “in connection with contract award or performance”. Some of these respondents made the following comments:

• The broad nature of the phrase “violation of Federal criminal law in connection with contract award or performance” places a heavy burden. The Government is in the best position to provide specific guidance to contractors as to the violations that would be considered covered by this new requirement. Otherwise, each contractor will have to develop its own list and explanations to its employees as to what constitutes criminal violations.
• If the FAR Council proceeds with the rule, it should provide a specific list of the criminal violations that the contractor is required to disclose.
• The self-reporting requirements should be revised to provide the specific circumstances under which self-reporting is required.
• The provision is vague in regard to the type of “criminal violation” covered, leaving open application of the rule to non-procurement related offenses. If an employee commits a criminal violation while driving on Federal lands in the course of performing a contract, must the traffic violation be reported to the agency OIG? Also, the agency OIGs may receive reports about violations of Federal tax law or Occupational Safety and Health laws that occur in connection with the performance of the contract, over which the OIGs do not have jurisdiction. This can result in unnecessary or inappropriate reports.
• The proposed rule does not elaborate on the nexus between the perceived criminal conduct and the Federal contract so as to trigger the reporting requirement. A contractor's silence could be alleged to be a false statement where the employer had “reason to believe” that one of its employees, agents, or subcontractors had violated criminal law in connection with a contract.
• The rule should define more clearly what is reportable and when the obligation to report is triggered.

One Government agency suggested adding “potential” to “violation.”

DoJ also suggested tightening the standard for disclosure by adding the phrase “involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code.”

Response: The Councils have adopted the more specific description of criminal law suggested by DoJ as responsive to many of the concerns expressed by the respondents.

As to nexus with the contract, the clause stipulates in paragraph 52.203-13(b)(3)(i) that the violation should have occurred “in connection with the award, performance, or closeout of this contract, or any subcontract thereunder.” With regard to the internal control system disclosure required in paragraph 52.203-13(c)(2)(ii)(F) and the cause for debarment or suspension in Subpart 9.4, the violation must be in connection with the award, performance, or closeout, of any Government contract performed by the contractor, or a subcontract thereunder, and the obligation to disclose information lasts until 3 years after final payment. If there is no connection to a Government contract performed by the contractor, or a subcontract thereunder, then it need not be disclosed.

The Councils do not consider it necessary to add “potential” to “violation” because that preceding language already is in terms of “credible evidence.” That does not necessarily mean that a violation has occurred, but the principals are looking for “credible evidence” that a violation has occurred. “Potential violation” would open it even wider and could result in too many unnecessary disclosures.

iv. Level of employee with knowledge. Several respondents wanted the rule to identify the level of contractor employee whose knowledge will be imputed to the contractor, such that the contractor has the requisite knowledge. Absent such identification, consistent with the doctrine of respondeat superior applied in Federal criminal law, a contractor may be deemed to have requisite knowledge warranting disclosure if any employee at any level is aware of conduct which may constitute a Federal criminal offense. This could cause a contractor to be accused of violating the mandatory disclosure provision before the contractor's management becomes aware of the offense and before the appropriate steps for disclosure may be undertaken. One respondent stated that it is unreasonable to expect all knowledge to be passed up the chain. Several respondents recommended revision of the proposed rule to require that a contractor principal must have the requisite knowledge of a Federal criminal law violation before that knowledge will be imputed to a contractor.

Response: The Councils concur that for debarment and suspension, a principal must have the requisite knowledge in order for mandatory disclosure to be applicable. See response under the heading “Suspension/Debarment”, “Who has knowledge?” at paragraph B.5.e.

c. Disclosure to OIG. One respondent considered that the proposed rule would essentially require contractors and subcontractors to become fraud detection and reporting entities. Must contractors become experts in forensic accounting and private investigation? This respondent considered that the proposed rule essentially would “deputize” contractors and subcontractors as agents of the OIG. One respondent also considered that the company is now acting as an agent of the Government.

Is “the agency OIG” the OIG for the agency which awarded the contract under which the action in question took place? One respondent was concerned when contractor is required to disclose to different inspectors general because the proposed rule is silent on what actions and procedural safeguards are to be implemented in the various offices of the Inspectors General. A contractor that deals with a variety of different Federal agencies will unreasonably be faced with significantly increased risk and uncertainty.

Several respondents considered that a likely outcome of the mandatory reporting to the agency OIG will be to remove from a contracting officer or agency the authority or the ability to settle and compromise the issues by a disclosure. One industry association indicated that member companies report that in their experience, the vast majority of potential violations disclosed to a contracting officer or other agency official are quickly resolved as an administrative matter. Once a matter is referred to the DoD OIG as a potential criminal or civil fraud matter, under the Contract Disputes Act the contracting officer loses his or her ability to compromise or settle the issue. One respondent was also concerned about the impact of the proposed rule on the influence and authority of the contracting officer. The respondent considered that disclosure to the OIG passes the leadership role on any subsequent investigation and review to the OIG's office and undercuts the authority and ability of the contracting officer to manage contracts.

One respondent noted that under the DFARS rule, the OIG only needs to be notified when appropriate. One respondent considered that mandatory notification to the OIG defeats the concept of internal audits and correction of possible irregularities. The respondent is concerned that, once the OIG is brought into the process, both the contracting officer and the contractor/subcontractor lose control of the process.

One respondent was concerned with the ability of the OIG to handle an increased level of reports. One respondent stated that their experience with the capability of the OIG's offices to deal with complicated, sophisticated and/or fact-intensive issues is very mixed at best. Current demands have placed substantial strain in the ability of the OIG's offices to support investigations, and delays are commonplace. “According to the respondent, ‘competing demands for resources to support overseas investigations and Homeland Security defense have drained whatever experienced resources existed” at the agency OIGs.

An agency OIG suggested replacing “agency Office of the Inspector General” with “A President-selected and Senate-approved Inspector General or designated Federal entity Inspector General.” The agency OIG stated that this better describes the correct agency to which the contractor should report potential violations.

Response: There is nothing in the proposed rule that “deputizes” contractors. The Councils have concluded that it is appropriate for contractors to send the reports directly to the OIG, with a copy to the contracting officer, because it is the OIG that is responsible for investigating the disclosure.

The disclosure would be to the OIG of the agency that awarded the subject contract. The Councils have added clarification that if a violation relates to more than one Government contract, the Contractor may make the disclosure to the agency OIG and Contracting Officer responsible for the largest dollar value contract impacted by the violation. If the violation relates to an order against a Governmentwide acquisition contract, a multi-agency contract, a multiple-award schedule contract such as the Federal Supply Schedule, or any other procurement instrument intended for use by multiple agencies, the contractor shall notify the OIG of the ordering agency and the IG of the agency responsible for the basic contract.

Whether OIGs can handle an increase in the level of reporting depends on the expected level of increase. The Councils do not anticipate that companies are going to flood the OIG with trivialities, as some respondents fear. The Council also notes that the agency OIGs were all strongly in favor of this rule.

The Councils do not agree with the suggestion of one agency IG that the rule should specify “A President-selected and Senate-approved Inspector General or designated Federal entity Inspector General.” Although this is probably accurate, the Councils consider it too complicated for some contractors to determine. It is the opinion of the Councils that, if a contractor submits a report to the wrong OIG, that OIG will forward it to the appropriate OIG.

Throughout the rule, the Councils have used the words “disclose” and “disclosure” for consistency, rather than in some places using the word “notify” or “report”.

4. Full Cooperation

The proposed rule states at paragraph (c)(2)(ii)(G) of FAR 52.203-XX (now 52.203-13) that a contractor Code of Business Ethics and Conduct shall, at a minimum, have an internal control system that provides “full cooperation with any Government agencies responsible for audit, investigation, or corrective actions.”

a. Waiver of Privileges/Protections/Rights

Many respondents expressed concern that compliance with the rules requiring disclosure and full cooperation would be interpreted to—

• Require contractors waive an otherwise valid claim of attorney-client privilege or protections afforded by the attorney work product doctrine, both protecting attorney-client communications; or
• Interfere with an employee's right under the Fifth Amendment of the U.S. Constitution covering the right of an individual not to be compelled to incriminate itself.

One respondent recommended addition of strong language to preserve privilege protections.

DoJ and an agency OIG indicated awareness of these concerns in their comments and recommended clarification in the final rule. DoJ proposed that the final rule state explicitly:

“Nothing in this rule is intended to require that a contractor waive its attorney-client privilege, or that any officer, director, owner, or employee of the contractor, including a sole proprietor, waive his or her attorney-client privilege or Fifth Amendment rights.”

Response: It is doubtful any regulation or contract clause could legally compel a contractor or its employees to forfeit these rights. However, the Councils have revised the final rule to provide such assurance. To address concern that cooperation might be interpreted to require disclosure of materials covered by the work product doctrine, the Councils have added a definition of “full cooperation” at 52.203-13(a) to make clear that the rule does not mandate disclosure of materials covered by the attorney work product doctrine.

For comparison purposes, it is instructive to refer to the flexible approach adopted in the USSG:

Waiver of attorney-client privilege and of work product protections is not a prerequisite to a reduction * * * unless such waiver is necessary in order to provide timely and thorough disclosure of all pertinent information known to the organization.

It also is worth pointing out the DoD Voluntary Disclosure Program never required waiver as a condition of participation. Contractors in that program routinely found ways to report wrongdoing without waiving the attorney-client privilege or providing their attorney memoranda reflecting their interviews that normally are covered by the work product doctrine.

Any limitation in this rule should not be used as an excuse by a contractor to avoid disclosing facts required by this rule. Facts are never protected by the attorney-client privilege or work product doctrine. Moreover, the Fifth Amendment has no application to corporations, so the only sensitive area is mandatory disclosure or cooperation by individuals or sole proprietors, which is addressed in the clarification.

b. Indemnification of Employees

Several respondents expressed concern that full cooperation will be interpreted as prohibiting a contractor from indemnifying its employees or their individual counsel to the extent permitted or required by state law or the contractor's charter or bylaws. Several respondents expressed concern that the Government may view indemnification of contractor employees as not cooperating. One respondent asked if there was a difference between “cooperation” and “full cooperation” and, more seriously, whether full cooperation restricted a contractor's ability to make counsel available to its employees. Several respondents pointed to the district court opinion in U.S. v. Stein, 435 F.Supp. 2d 330 (SDNY 2006), and 440 F.Supp. 2d 315 (SDNY 2006) that suggests the Government viewed KPMG's practice of paying for employees' legal costs pursuant to indemnification rules was not “cooperation” favored by the prosecutors in that case.

Response: With regard to indemnification of employees for legal costs, State law—not Federal—controls. Just as full cooperation cannot mean a company forfeits its attorney-client privilege, there is no reason to think it means employees forfeit their right to indemnification from their employers. On December 12, 2006, DOJ addressed this issue in a memorandum sent to all DoJ attorneys by Deputy Attorney General Paul McNulty (“McNulty Memorandum”), stating:

Prosecutors generally should not take into account whether a corporation is advancing attorneys' fees to employees or agents under investigation and indictment. Many state indemnification statutes grant corporations the power to advance the legal fees of officers under investigation prior to a formal determination of guilt. As a consequence, many corporations enter into contractual obligations to advance attorneys' fees through provisions contained in their corporate charters, bylaws or employment agreements. Therefore, a corporation's compliance with governing state law and its contractual obligations cannot be considered a failure to cooperate.

c. Requirement to Fire an Employee

One respondent asked that the rule clarify that cooperation does not mean a contractor must fire an employee.

Response: It is inappropriate for the Government to direct a contractor to fire an employee, although the Government may require that an employee be removed from performance of the Government contract. However, most corporate compliance programs assert that violation of law or company policy is grounds for dismissal. Also note the internal control system requirements for principals at paragraph (c)(2)(ii)(B) of the clause.

d. Ability To Conduct a Thorough and Effective Internal Investigation

Several respondents expressed concern that cooperation or disclosure will be interpreted to interfere with a contractor's ability to conduct a thorough and effective internal investigation. Some respondents were concerned that a contractor continuing to investigate a matter after reporting would be deemed not cooperating. One respondent recommended that the rule state explicitly that: “A contractor has a reasonable time to investigate a potential investigation * * * and that nothing in the rule prohibits or restricts a contractor from conducting an internal investigation.”

Response: Any interpretation of full cooperation that would suggest a limit on contractors conducting internal investigations would be clearly at odds with the intent of the rule, which encourages compliance program investigations, reporting, and cooperation.

e. Defending a Proceeding or Dispute Arising From or Related to Disclosure

Various respondents expressed concern that full cooperation will be interpreted to preclude a contractor from defending itself in a proceeding or dispute arising from or related to the disclosure. One respondent raised concerns that a rule mandating full cooperation could be interpreted as prohibiting a contractor from “vigorously defending its actions.” Another respondent observed that full cooperation might require a contractor to waive its right to appeal the results of an audit.

Response: Nothing in the rule would foreclose a contractor from advancing a defense or an “explanation” for the alleged fraud or corruption arising in a Government contract. This includes being free to use any administrative or legal rights available to resolve any dispute between the Government and the contractor. The rule is intended simply to require the contractor to be forthcoming with its customer, the Government, with regard to credible evidence relating to alleged fraud or corruption in its Government contracts.

f. Expansion of Audit Rights and Access to Records

Various respondents asked to what extent full cooperation overrode the limits on Government audit rights and access to records limitations, giving the Government “unfettered access” to individuals to conduct interviews, even though the current audit access clauses are limited to documents. Expanding on that, one respondent also asked if the rule requires contractors to give the Government “full access to their financial and proprietary information, beyond that required by existing contract clauses.” Another respondent also observed that the Government may invoke the requirement in connection with disputes before the Board of Contract Appeals or U.S. Court of Federal Claims. One respondent requested clarification that the cooperation requirement applies only to agencies affected by the conduct and not the entire Government.

Response: The proposed rule was not intended to have any application or impact on the Government's exercise of its audit and access to records rights in the routine contract administration context except as the issue arises when a contractor discloses fraud or corruption or the Government independently has evidence sufficient to open an investigation of fraud and solicit the contractor's cooperation. The issue of contractor cooperation in this rule arises primarily in the context of Government investigation of contract fraud and corruption and any application of this rule in any other context by the Government would be clearly overreaching.

g. Inadvertent Failure as Non-Cooperation

One respondent feared that an “inadvertent” failure to provide documents in a routine DCAA audit would be deemed non-cooperative.

Response: The rule has no application to routine DCAA audits.

h. Need for Definition

Many respondents asked for an expanded definition of “full cooperation” in order to reduce the potential for misinterpretation of the rule, resulting in the concerns addressed in the preceding paragraphs.

Response: Contractors are not expected to block Government auditors and investigators' access to information found in documents or through its employees in furtherance of a contract fraud or corruption investigation.

Generally speaking, it is also reasonable for investigators and prosecutors to expect that compliant contractors will encourage employees both to make themselves available and to cooperate with the Government investigation.

That also applies to responding to reasonable Government requests for documents. Ignoring or offering little attention to detail in responding to auditor or investigator requests or subpoenas for documents or information may, in some circumstances, be obstruction of justice and, if established, certainly would not be deemed full cooperation.

According to the USSG, cooperation must be both timely and thorough:

• To be timely, the cooperation must begin essentially at the same time as the organization is officially notified of a criminal investigation.
• To be thorough, the cooperation should include the disclosure of all pertinent information known by the organization.

—A prime test of whether the organization has disclosed all pertinent information is whether the information is sufficient for law enforcement personnel to identify—

—The nature and extent of the offense; and

—The individual(s) responsible for the criminal conduct.

—However, the cooperation to be measured is the cooperation of the organization itself, not the cooperation of individuals within the organization. If, because of the lack of cooperation of particular individual(s), neither the organization nor law enforcement personnel are able to identify the culpable individual(s) within the organization despite the organization's efforts to cooperate fully, the organization may still be given credit for full cooperation.

The DoD Voluntary Disclosure Program described expected cooperation in some detail in its standard agreement (the “XYZ Agreement”), and it may be a useful reference in this circumstance where the contractor discloses credible evidence of fraud or corruption under this rule. However, the detail found there goes significantly beyond the scope of this rule and is best addressed on a case-by-case basis.

The final rule includes a definition that incorporates some of the concepts in the USSG and the general principle that cooperation must be both timely and thorough. It is intended to make clear that cooperation should include all information requested as well as all pertinent information known by the contractor necessary to complete the investigation, whether the information helps or hurts the contractor. Contractors are expected to make their employees available for Government investigators and auditors investigating contract fraud and corruption and respond in a timely and complete manner to Government requests for documents and other information required to conduct an investigation of contract fraud and corruption. Responding to concerns expressed by the respondents, the Councils have incorporated the following definition into the final rule at 52.203-13(a):

“Full cooperation”—

(1) Means disclosure to the Government of the information sufficient for law enforcement to identify the nature and extent of the offense and the individuals responsible for the conduct. It includes providing timely and complete response to Government auditors' and investigators' requests for documents and access to employees with information;

(2) Does not foreclose any contractor rights arising in law, the FAR, or the terms of the contract. It does not require—

(i) A contractor to waive its attorney-client privilege or the protections afforded by the attorney work product doctrine; or

(ii) Any officer, director, owner, or employee of the contractor, including a sole proprietor, to waive his or her attorney client privilege or Fifth Amendment rights; and

(3) Does not restrict a contractor from—

(i) Conducting an internal investigation; or

(ii) Defending a proceeding or dispute arising under the contract or related to a potential or disclosed violation.

5. Suspension/Debarment

a. New Cause for Suspension or Debarment

Various respondents expressed concern that the proposed rule establishes failure to timely disclose a violation as a new cause for suspension or debarment, rather than suspension or debarment just for the underlying violation.

Response: The requirement for timely disclosure could in some circumstances be considered a new cause for suspension or debarment. However, the question of timely disclosure will not come up unless the Government independently discovers that there has been a significant overpayment, a violation of the civil FCA, or a violation of Federal criminal law to be disclosed, that the Contractor knew about and elected to ignore. It is unlikely that any contractor would be suspended or debarred absent the determination that a violation had actually occurred. Present responsibility is the ultimate basis of suspension or debarment.

b. Unnecessary and Not Good Policy

Many respondents criticized the additional suspension and debarment coverage in the proposed rule as unnecessary and redundant to existing regulations that—

• Provide strong incentives for contractors to voluntarily disclose criminal behavior;
• Require a prospective contractor to demonstrate a satisfactory record of integrity and business ethics; and
• Provide a “panoply of methods for prosecuting and eliminating those companies that fail to abide by the highest ethical and legal standards.”

One respondent stated that the proposed suspension and debarment for “violation of Federal criminal law” simply repeats much of what is contained in FAR 9.406-2 and 9.407-2. Another respondent considered the suspension and debarment regulations punitive.

Response: As addressed in the preceding paragraph, the added causes for suspension/debarment add the requirement to timely disclose the violation and are not duplicative of the violation itself as a cause for suspension/debarment.

The suspension and debarment policies and standards are not punitive. The purpose of suspension and debarment is to ensure that the Government does business only with responsible contractors, not to punish. This final rule continues to embrace the responsibility standard.

c. Mitigating Factors

Several respondents were concerned whether the proposed rule maintains the current scheme of ten mitigating factors at FAR 9.406-1(a) or renders it meaningless by establishing failure to disclose itself as a cause for debarment (thus preventing “voluntary” disclosure).

Response: The mitigating factors currently at FAR 9.406-1(a) will continue to be used, and a contractor's timely disclosure to the Government will continue to be a mitigating factor. As stated in the response in paragraph B.3.a.vi. “Incentives”, above, the incentives in the FAR and the USSG are not limited to “voluntary” disclosures but to “disclosures.”

Even if disclosure is “mandatory,” incentives will still be offered to promote compliance. The Councils do not recommend any revision as a result of these comments.

d. Undefined Terms

Many respondents expressed concern that terms such as “knowing,” “timely” “reasonable grounds to believe,” and “overpayment” are undefined and will thus put contractors at risk. One Government respondent suggested adding “knew, should have known, or” to “had reasonable grounds to believe.”

Response: See responses under paragraph B.3.b.”Vagueness of rule.” for discussions of “timely,” and “reasonable grounds to believe.”

With regard to the term “knowing failure to disclose” the “knowing” refers to the failure to disclose. “Knowing failure to disclose” was added in the proposed rule to the causes for debarment at FAR 9.406-2(b)(1)(vi) and the causes for suspension at FAR 9.407-2(a)(8). Requiring a “knowledge” element to the cause for action actually provides more protection for contractors. The Councils do not agree with adding “or should have known.” The principals are only required to disclose what they know. Further, using the standard of “credible evidence” rather than “reasonable grounds to believe” will help clarify “knowing” (See response at “Vagueness of rule” at paragraph B.3.b.i., “Reasonable grounds to believe”).

The term “overpayment” is described in a number of FAR clauses and provisions and does not require a definition with respect to suspension and debarment. For further discussion of overpayments, see response at “Suspension and Debarment”, paragraph B.5.f. “Limit or abandon suspension/debarment for failure to disclose overpayment”.

e. Who has knowledge?

One respondent stated that a contractor should be suspended or debarred for failing to disclose violations of Federal criminal law only if a “principal” of the company (as defined in the proposed contract clause) has knowledge of the crime. Failure to disclose crime should not be a basis for suspension or debarment if lower-level employees, who are not managers or supervisors, commit a crime and conceal the crime from the contractor's supervisory-level personnel.

Response: Paragraph (a)(2) of the clause at FAR 52.209-5 defines “principals” to mean “officers; directors; owners; partners; and, persons having primary management or supervisory responsibilities within a business entity (e.g. , general manager; plant manager; head of a subsidiary, division, or business segment, and similar positions)”. The Councils agree with the respondent and have revised 3.1003(a)(2), 9.406-2(b)(1)(vi), and 9.407-2(a)(8) to make disclosure mandatory when a principal of the company has knowledge. The Councils have also added the definition of a principal at FAR 2.101 because it now applies to more than a single FAR part, and revised both definitions to be singular rather than plural.

The Councils note that this definition should be interpreted broadly, and could include compliance officers or directors of internal audit, as well as other positions of responsibility.

f. Limit or Abandon Suspension/Debarment for Failure To Disclose Overpayment

One respondent stated that the proposed ability to suspend or debar for failure to disclose an “overpayment” on a Government contract may create operational difficulties because contracts are subject to reconciliation processes with payments audited and adjusted over time. Likewise, another respondent stated that singling out routine contract payment issues, which are daily events, with errors on both sides, is simply unworkable. The respondent cites a situation where a defense contractor did disclose an overpayment to the payment office, only to be told that it was wrong, yet was later made the subject of a qui tam action. Another respondent likewise objected to making reporting of overpayments grounds for suspension or debarment rather than a matter of contract administration. The respondent stated that the proposed rule does not connect overpayments to the criminal law violations upon which the rest of the proposed rule is focused.

One respondent recommended that the FAR Council should abandon the proposed changes that would make failure to disclose an “overpayment” a new cause for suspension or debarment because a number of current FAR clauses already require the contractor to disclose specific types of overpayments, e.g. , 52.232-25, 52.232-26, 52.232-27, and 52.212-4(i)(5). These clauses treat such overpayments as a matter of contract administration and do not treat them as a matter of possible fraud and a basis for suspension or debarment. In addition, the Part 9 provisions should state explicitly that the cause for suspension or debarment is for violation of the requirements in FAR 52.232-25, 52.232-26, 52.232-27, and 52.212-4(i)(5). The respondent noted that the proposed rule did not demonstrate that the present FAR provisions requiring the disclosure of overpayments are ineffective.

On the other hand, another respondent stated that contractors currently have no obligation to report overpayment.

One respondent was more specifically concerned that overpayments can result from indirect rate variances or similar credits that can occur years after contract performance and that can put the contractor in an over-billed situation. The severe sanctions that could inure to contractors so situated seem patently unfair. The respondent suggested either excluding rate variances or applying the section only to payments made during or immediately following contract performance.

Another respondent was concerned that this ethics rule creates potential inconsistency in the treatment of overpayments with the existing regulatory provisions of the FAR, and recommends deletion of the issue of “overpayment” as a basis for suspension and debarment.

DoJ suggested some answers to these concerns. DoJ considers that a duty to disclose an overpayment is just as important as the disclosure of criminal violations, and the requirement to disclose both will save the contractor from having to decide whether a criminal violation has in fact occurred in the case of an overpayment. However, DoJ concedes that a materiality requirement is appropriate to limit the scope of the requirement to disclose overpayments.

Response: The Councils dispute the allegation that “contractors currently have no obligation to report overpayments” and refers the respondent to the payment clauses at FAR 52.232-25, 52.232-26, 52.232-27, and 52.212-4(i)(5). Although other clauses already require reporting of overpayment, this inclusion of the requirement in Subpart 9.4 to disclose significant overpayments is necessary to make it clear that, if a contractor does not meet this condition of the contract, it can be subject to suspension or debarment.

The Councils agree with the suggestion by the DoJ that it is appropriate to limit the application of suspension or debarment to cases in which the unreported overpayment is significant. This will resolve some of the respondents' concerns over routine contract payment issues. The Councils have revised the final rule to address only significant overpayments, which implies more than just dollar value and depends on the circumstances of the overpayment as well as the amount. Since contractors are required by the Payment clauses to report and return overpayments of any amount, it is within the discretion of the suspension and debarment official to determine whether an overpayment is significant and whether suspension or debarment would be the appropriate outcome for failure to report such overpayment.

Rate variances do not need to be specifically excluded by the case because this issue is already taken care of in Part 32 and the Payment clauses. Rate variances are not considered overpayments until the rates are determined. The suggestion to apply the section only to payments made during or immediately following contract performance would not necessarily exempt rate variances, depending on when the rates are determined.

Further, the Councils decided to exclude knowing failure to report overpayments that result from contract financing payments, as defined in FAR 32.001, as grounds for suspension or debarment. Even though such overpayments must be reported and returned under the Payment clauses, these ongoing payments that are not the final payment on a contract are often based on estimates, and are subject to correction as the contract progresses. This rule is aimed at the type of overpayment that the contractor knows will result in unjust enrichment, and yet fails to disclose it.

The Councils have ensured that there is no overlap or inconsistency between this final rule and the current FAR requirements relating to overpayment, as well as the Contract Debt case published as part of Federal Acquisition Circular 2005-27 on September 17, 2008 (73 FR 53997).

g. Blacklisting

One respondent had a different concern, that the proposed changes in Part 42 with regard to past performance would allow “blacklisting” of contractors through consideration of “integrity and business ethics” in the past performance evaluation without due process protections. The respondent stated that the suspension and debarment procedures are the proper means to address responsibility issues.

Response: A contractor's satisfactory record of integrity and business ethics has long been one of the required elements for determining that a prospective contractor is responsible (see FAR 9.104-1(d)). The rules for assessing responsibility at FAR Subpart 9.1 provide for sufficient standards to ensure that offerors are treated fairly. FAR 15.306(b)(1) and (d)(3), and 42.1503(b) give the contractor the opportunity to comment on adverse past performance. The Councils do not recommend any change as a result of this comment.

h. Amendment of the Civil FCA

One respondent believed that the proposed cause for suspension/debarment language effectively amends the civil FCA. The respondent objected to changing contractors' obligations regarding overpayments without using the legislative procedure.

Response: The Councils disagree that the rule intended to, or did, amend the civil FCA outside the legislative process. The civil FCA provides a legal tool to counteract fraudulent billings turned in to the Federal Government by encouraging “whistleblowers” who are not affiliated with the Government to file actions against Federal contractors, claiming fraud against the Government. It also provides incentives to contractors to self-disclose. This does not preclude the Government from imposing an obligation on Federal contractors to themselves disclose to the Government if instances of overpayment are known to the company principals, and to hold them liable for knowing failure to disclose such an overpayment. This rule provides another tool to determine present responsibility of Government contractors.

FAR Subpart 9.4 provides debarment/suspension as a possible consequence for conviction of or civil judgment for commission of fraud or a variety of criminal offenses, although those statutes may already provide criminal or civil penalties for violation thereof. For example, the Sherman Act (15 U.S.C. 1-7) provides statutory penalties, including fines and imprisonment, for violation of the antitrust provisions of the statute. It is not inconsistent with the statute, nor does it require legislative amendment to include in the FAR that violation of the Federal statutes in submission of an offer is cause for debarment or suspension.

i. Technical Corrections

The Councils moved FAR 3.1002(c) to 3.1003(a)(2), because it presents a requirement rather than just policy guidance. In addition, the term “Mandatory” was removed from the phrase “Mandatory requirements” at 3.1003, because it is redundant. The title of paragraph (a)(1) of FAR 3.1003 has been amplified to indicate that this paragraph is describing contractor requirements.

6. Extend to Violation of Civil False Claims Act

a. Support Application to Disclosure of Violations of the Civil FCA

The Department of Justice, Civil Division, which is responsible for the enforcement of the civil FCA, fully supports the extension of the proposed rule to require that contractors report violations of the civil FCA, 31 U.S.C. 3729 et seq., and to provide that the knowing failure to timely disclose such violations may be grounds for suspension or debarment. Various respondents, including agency OIGs, express support for these provisions.

Response: Concur.

b. Same Issues as Raised With Regard to Other Mandatory Disclosures

Numerous respondents suggested that certain of their objections to the original proposal to require disclosure of criminal violations and to make a knowing failure to timely disclose such violations grounds for suspension or debarment, also apply to an expanded requirement that contractors disclose civil FCA violations. For example, some commented that disclosure should not be required because the conduct constituting violation of federal criminal law or the civil FCA is potentially broad and subject to varying interpretations by the Government, contractors and courts (and by relators in civil qui tam suits); that the requirement that violations be “timely” disclosed upon “reasonable grounds to believe” a violation has occurred are subject to varying interpretations as to when and under what circumstances a violation must be disclosed; that there is no rational basis for the proposed rule; that the rule would impose an unreasonable burden on contractors; and, that knowing failure to timely disclose should not be cause for suspension or debarment.

Response: These areas of concern common to both criminal and civil violations are addressed in other sections of this report. As discussed more fully elsewhere, the Councils have replaced the “reasonable grounds to believe” standard of the proposed rule with a “credible evidence” standard in the final rule, and to specify that the violation must have a nexus to contract award, performance or close-out, and to clarify that it is the knowledge of the principal that triggers the suspension and debarment cause. See responses under “Vagueness of rule” at paragraph B.3.b.i. (Reasonable grounds to believe); B.3.b.ii.(Timely disclosure); B.3.b.iii. (Criminal violation in connection with contract award or performance); and B.3.b.iv. (Level of employee with knowledge).

c. Issues Particular to the Civil FCA

i. Difficult to determine if violation has occurred. Several respondents urged that contractors should not be required to disclose violations of the civil FCA or be subject to suspension or debarment for a knowing failure to do so on a timely basis because, they suggest, the potential misconduct covered by the Act is broad, and the application of the statute raises many difficult factual and legal issues that the Government, contractors, relators and courts interpret in various ways. For example, one respondent argues that the contractor and the Government are not always aligned on whether a violation of the civil FCA has occurred, and suggests that it is impractical to assume that an average contractor employee will know definitively when a violation of the civil FCA has occurred. Several respondents observe that that there are many difficult legal and factual issues that arise in civil FCA matters, such as whether a submission constitutes a “claim”, whether a statement is “false,” and whether the person making the statement or submitting the claim acted with the requisite knowledge. Another respondent argues the courts are in conflict over what conduct constitutes a violation of the civil FCA. Another respondent considers it unfair to require contractors to make civil FCA liability determinations given conflicting judicial interpretations of the civil FCA and the contractor's inability to access relevant facts. This respondent argues that certain Federal appellate courts and the United States Supreme Court have read a materiality requirement into the civil FCA even though that element is not stated explicitly in the text. One respondent cites a split in the circuits regarding whether an entity that is subject to complex regulatory requirements can be held liable under the civil FCA when the entity bases its conduct on a reasonable interpretation of an ambiguous statute or regulation. Another respondent states that whereas federal crimes are fairly well-defined, novel and aggressive interpretations of the civil FCA have created an environment in which many claims of breach of a contract might be construed as civil FCA violations.

Based on the premise that violations of the civil FCA are difficult to define, several respondents concluded that contractors will be subject to suspension and debarment if the contractor misinterprets the circumstances and does not report a violation, even if there exists an honest disagreement about whether a violation of the civil FCA has occurred.

Response: The Councils do not agree that the requirements of the civil FCA cannot be reasonably ascertained and understood by contractors, and expects that contractors doing business with the Government are taking appropriate steps to ensure their compliance with that statute and all other applicable laws. The most recent amendments to the statute were made in 1986, and a significant body of case law interpreting the statute, and the 1986 amendments in particular, has developed in that time period. These cases interpret the various elements of a civil FCA violation, including the definition of a claim, falsity, knowledge, and damages.

Although the Councils recognize that some issues concerning the proper application of the civil FCA remain unsettled and subject to further judicial interpretation, this is not unique to the civil FCA.

Moreover, the disclosure requirement applies only where the contractor has “credible evidence” that a violation of the civil FCA has occurred. The contractor is subject to suspension and debarment for failure to timely disclose the violation only where the contractor does so knowingly. Genuine disputes over the proper application of the civil FCA may be considered in evaluating whether the contractor knowingly failed to disclose a violation of the civil FCA.

In this regard, the Councils note that the mere filing of a qui tam action under the civil FCA is not sufficient to establish a violation under the statute, nor does it represent, standing alone, credible evidence of a violation. Similarly, the decision by the Government to decline intervention in a qui tam action is not dispositive of whether the civil FCA has been violated, nor conclusive of whether the contractor has credible evidence of a violation of the civil FCA.

ii. Broad scope of civil FCA. Several respondents suggested that requiring contractors to disclose violations of the civil FCA significantly expands the situations in which disclosure must be considered, and notes that the civil FCA can be violated even in situations where the Government suffers no financial loss. One respondent states that the civil FCA encompasses an “almost limitless universe of activities.”

Response: The Councils do not agree that requiring disclosure of civil FCA violations will significantly broaden the situations where disclosure must be considered. Concerning the suggested breadth of the civil FCA, please see response to “Issues particular to the civil FCA”, at paragraph B.6.c.i. “Difficult to determine if violation has occurred”. The first proposed rule required contractors to disclose significant overpayments and violations of criminal law in connection with a Government contract or subcontract awarded thereunder, and the addition of the civil FCA is a natural extension of the rule. When a claim or payment comes under review, it often is not known at the outset of the investigation whether the matter is an overpayment, or a civil or criminal violation. In many cases, the same investigation must be done to determine the nature of the conduct at issue. The same fraud may be actionable under the civil FCA or its criminal analogs, and require proof of the same general elements. See, e.g., 18 U.S.C. 287 (criminal False Claims Act); 18 U.S.C. 1001 (false statements).

Moreover, the fact that a course of conduct can violate the civil FCA even if the Government does not suffer a financial loss does not mean that disclosure is not relevant to the contractor's present responsibility. For example, the Government may avoid a financial loss because a contracting officer alertly catches and declines to pay a false or fraudulent claim, or perhaps because the false claim is disclosed by the contractor.

iii. Mitigation in civil FCA for voluntary disclosure. One respondent argues that there is no need to make failure to timely disclose a civil violation of the civil FCA a basis for suspension and debarment because the civil FCA already provides that damages may be reduced from trebles to doubles where the contractor discloses a violation to the United States. Another respondent suggests that the proposed FAR rule would convert these otherwise voluntary disclosures into mandatory disclosures, thereby preventing contractors from benefiting from the damages reduction provision of the civil FCA. One respondent requests that the final rule clarify that any mandatory reporting obligation is not intended to and does not prevent a contractor from seeking, and the Government from providing, reduced damages as a result of a disclosure made in compliance with the new contract provision.

Response: The Councils do not agree that the reduced damages available to contractors who disclose violations of the civil FCA in accordance with that Act obviates the need for the proposed amendment to make a failure to timely disclose a violation the basis for suspension or debarment. These provisions address two separate Governmental interests. The damages provisions of the civil FCA address the Government's ability to recoup its loss as a result of a violation, and recognize that timely disclosure is an important means for mitigating that loss. Suspension and debarment is concerned with the contractor's present responsibility. Timely disclosure of violations of the civil FCA is an important indicator of the contractor's present responsibility.

The mitigating provisions of the civil FCA apply to any disclosure that meets the requirements set forth in 31 U.S.C. 3729(a)(A). There is nothing in the FAR rule that would preclude a contractor from meeting the actual requirements of the reduced damages provision of the civil FCA. (See response at paragraphs B.3.a.vi. and B.5.c. discussing the mitigating factors in the USSG and in the FAR.) In its comments to the proposed rule, the Civil Division of DOJ, which enforces the civil FCA for the United States, noted that a contractor that meets both the disclosure requirements of the FAR and the civil FCA “would receive the dual benefit of qualifying to seek reduced damages under the civil FCA and avoiding the potential for suspension and debarment under the FAR.”

iv. Proposed amendments to the civil FCA. Several respondents suggest that a contractor making a mandatory disclosure of a violation of the federal civil FCA risks prompting a potential relator to file a qui tam suit based on the disclosure, and note that the public disclosure bar under existing law likely would not bar such a suit. These respondents further suggest that this risk is increased if proposed amendments to the civil FCA (S.2041 and H.4854) are enacted because they would eliminate the public disclosure bar as a jurisdictional defense to a qui tam suit.

Response: The Councils recognize that mandatory disclosure of a violation of the civil FCA presents a risk that a qui tam action will follow. This risk is not unique for disclosures of civil FCA violations; the same risk arises from disclosures of overpayments and violations of criminal law. Furthermore, the underlying violation itself presents a risk of a qui tam action. Timely disclosure of a knowing violation offers the contractor an opportunity to demonstrate its present responsibility to avoid suspension or debarment, and to obtain a reduction in damages under the civil FCA.

v. Healthcare and banking. Several respondents disagreed with the view expressed by DOJ that the civil FCA reporting requirement imposes on Government contractors the same disclosure standards as those required of the healthcare and banking industries, and that no law requires disclosure of a civil FCA violation.

Response: See response, in paragraph B.3.a.iii. a. under “Mandatory disclosure to the OIG”, “More far-reaching”.

vi. Inherently governmental. One respondent objects that requiring contractors to disclose violations of the civil FCA to the Government would force contractors to interpret and enforce Federal law, which epitomizes an inherently governmental function.

Response: The Councils disagree that the mandatory disclosure provisions result in a transfer of an inherently governmental function to contractors. As noted in response B.6.c.i. above, individuals and entities contracting with the Government are subject to the civil FCA, and the Government expects that its contractors will take appropriate steps to ensure their compliance with all applicable laws. Compliance necessarily requires that contractors interpret the law as it may apply to their own circumstances and conduct, and this obligation is no different whether the law is civil or criminal. The Government will continue to exercise its independent judgment as to the proper interpretation of the civil FCA, to enforce the civil FCA consistent with applicable law, and to pursue violations of that law where appropriate, irrespective of whether those violations are brought to its attention by a contractor's disclosure or otherwise.

vii. Technical correction. One respondent is concerned that with addition of disclosure of violations of the False Claims Act, it is not entirely clear whether the limiting clause “in connection with the award or performance of this contract or any subcontract thereunder” applies to reporting both violations of Federal criminal law and violations of the civil FCA.

Response: Concur. The Councils have modified the rule accordingly.

7. Application to Acquisition of Commercial Items

a. Support Application to Acquisition of Commercial Items

An agency OIG, in commenting on the first proposed rule, believed that the responsibility of the contractor to report potential violations of criminal law or safety issues related to Government contracts or subcontracts should not be based on contract type and should not exclude commercial contracts from the reporting requirement.

In response to the question on the expansion of the second proposed rule to apply to commercial items, various respondents, including many agency OIGs, support application to contracts for the acquisition of commercial items.

Response: Concur.

b. Do Not Support Application to Acquisition of Commercial Items

Several respondents state that the proposed rule is inconsistent with Public Law 103-355 and FAR Part 12.

Another respondent is concerned that application of the proposed rule to commercial acquisitions will be difficult for educational institutions to implement.

Another respondent states that DoJ fails to show any deference to OFPP with respect to commercial item policy, asserting without any rationale or elaboration that there would be no reason to exclude so-called commercial item contracts. This respondent states that the rule cannot be applied to commercial items without specific authorization by Executive Order or statute.

One respondent believes that applying Government-unique clauses to commercial suppliers will drive them away from the Government marketplace. Since this respondent recognizes that this is now required by statute, they will continue to seek a repeal of the statute.

Another respondent recommends against requiring commercial item contractors to develop new, Government-only ethics standards that result in a company having two standards of conduct, one for Government business and one for everything else.

Response: The disclosure requirements of the new statute specifically apply to commercial items. Furthermore, the statute includes the words “pursuant to FAR Case 2007-006 or any follow-on FAR case” which the Councils interpret as covering the inclusion of the civil FCA as addressed in the second proposed rule.

c. Application to Commercial Subcontracts

One respondent questions whether application of the proposed rule to the business practices of a commercial vendor that has no direct contractual relationship with the Federal Government has any relevance to assuring proper stewardship of Federal funds.

One respondent is concerned that without a more distinct definition of “subcontractor,” the flowdown obligation may be applied more broadly than necessary. The respondent requests additional guidance in order to distinguish actual subcontractors from entities that may be contracted to provide collateral services to the commercial contractor (e.g., service vendors, licensors, corporate subsidiaries).

Further, another respondent states that revision to FAR Subpart 44.4 or FAR clauses 52.212-4 or 52.212-5 and clause 52.244-6 would be necessary before this requirement can be flowed down to commercial item subcontractors, but because the proposed rule has neglected to specify changes, there is no proposed authorization to revise those clauses in the final rule.

Response: “Subcontract” and “subcontractor” are defined at FAR 44.101. To clarify the meaning in this context, the Councils have borrowed from those definitions for use in the text at 3.1001 and in the clause at FAR 52.203-13.

The Councils are authorized to make any revisions to Subpart 44.4, Part 12 and Part 44, necessary to conform changes in the final rule, as long as changes in the final rule are reasonably foreseeable from either the proposed rule text or the discussions in the preamble. This constitutes adequate notice to the public. Both the text and preamble of the May 16, 2008, proposed rule were specific that the rule would apply to subcontracts. The Councils have made appropriate conforming changes to 52.212-5 and 52.244-6.

d. Other Concerns

One respondent questions whether the phrase “if 52.212-4 appears in this contract” (52.203-13(c)) is another way of saying it is a commercial item contract.

Response: Yes, inclusion of clause 52.212-4 in the prime contract would indicate that it is a contract for the acquisition of commercial items. However, now that the final rule requires flow down to commercial subcontracts, this phrase is inadequate for indicating a subcontract for commercial items, and has been revised accordingly.

e. Comments on the First Proposed Rule That Are No Longer Applicable

One respondent was concerned that the opportunity for substantial confusion exists with the rule and recommends additional guidance on how the rule impacts companies selling commercial items under FAR Part 8 acquisitions.

Another respondent was concerned that the proposed language at 3.1004 “awarded under FAR Part 12” is likely to be misunderstood as applying only when the policies of FAR Part 12 are used exclusively and the procedures in Parts 13, 14, and 15 are not used.

Another respondent was concerned that the proposed rule does not properly address the exemption for commercial item vendors.

One respondent was concerned that the proposed rule does not justify imposing the new cause for suspension or debarment based on failure to disclose a “violation”, and that will also place restrictions on commercial contractors that are not required by law and not consistent with the commercial market place.

Response: These comments are no longer applicable because the statute now requires application of most of this rule to commercial item contracts.

8. Application to Contracts To Be Performed Outside the United States

a. Support Application Outside the United States

Four respondents to the first proposed rule questioned the exceptions for overseas contacts.

• DoJ disagreed with excluding contracts performed entirely outside the United States from the requirements of the rule. The respondent indicates that the United States is still party to such contracts and potentially a victim when overpayments are made or when fraud occurs in connection with the contacts.
• One respondent was concerned that the rule exempts contracts performed overseas without providing an explanation as to why a basic policy of a code of ethics and business conduct should not apply overseas.
• An agency OIG believed that the responsibility of the contractor to report potential violations of criminal law or safety issues related to Government contracts or subcontracts should not be based on contract type and should not exclude contracts performed outside the United States from the reporting requirements.
• Another agency OIG believed that it is counterproductive to exclude contracts performed entirely outside the United States because the United States is still party to such contracts and may be victimized when overpayments are made or fraud occurs in connection with those contracts. The respondent also argues the contracts require greater vigilance because they are performed overseas where U.S. resources and remedies are more limited; and that the inclusion would reduce the vulnerabilities that often plague overseas programs and increase the effectiveness of those programs.

In response to the proposed expansion overseas in the second proposed rule, various respondents, including several agency OIGs, support making the requirements of this rule applicable to contracts and subcontracts performed outside the United States.

Response: Concur.

b. Do Not Support Application Outside the United States

One respondent raised the concern that if any part of the work is performed outside the United States, labor and privacy laws in Europe would prohibit mandatory reporting by employees.

Another respondent is concerned that extension of the requirements to contracts and subcontracts performed outside the U.S. will likely have a significant and negative effect on academic institutions' ability to engage international partners. It is inappropriate and impractical to expect our international partners to do business in the same way as U.S. organizations. Many foreign academic institutions are instrumentalities of foreign governments and are subject to their own laws and regulations. Without flexibility, it will be impossible to pursue the international research and education

One respondent also believes that it is unreasonable and impractical to expect foreign firms to understand and be able to comply with the unique procedural requirements the U.S. imposes on its contractors. This respondent recognizes that this is now required by statute and it will seek a repeal of the statute.

Response: The disclosure requirements of the new statute specifically apply to acquisitions to be performed outside the United States. Furthermore, the statute includes the words “pursuant to FAR Case 2007-006 * * * or any follow-on FAR case” which the Councils interpret as covering the inclusion of the civil FCA as addressed in the second proposed rule.

9. Other Applicability Issues

a. Educational Institutions

i. Exempt educational and research institutions. One respondent requested that educational and research institutions be granted the same exemption afforded small business by making the requirement for a formal training and/or awareness program and internal control systems inapplicable to such institutions.

Response: By passing the “Close the Contractor Fraud Loophole Act,” Congress made clear its preference for fewer, rather than more exemptions. The requirements at 3.1002(b) are that the ethics and compliance training program be suitable to the size of the entity and extent of its involvement in Government contracting. Further, this regulation applies only to contracts using appropriated funds, not to grants.

ii. Imposition of procurement requirements on grant recipients. One respondent stated that OMB regulation 2 CFR 215.40 forbids agencies to impose procurement requirements on grant recipients unless required by statute or Executive order or approved by OMB.

Response: This rule is not imposing any requirements on grant recipients. The FAR does not apply to contracts awarded using grant money. Federal Government grant recipients who are also Federal Government contractors must comply with both the grant regulations and the FAR, as applicable.

b. Subcontractors

Various responses were received on the obligations imposed by this rule between contractors and subcontractors and the flow down of this rule to subcontractors.

Response: The Councils note that the same rationale that supports the application of the rule to prime contractors supports the application to subcontractors. The same reasonable efforts the contractor may take to exclude from its organizational structure principals whom due diligence would have exposed as engaging in illegal acts are the same reasonable efforts the contractor should take in selecting its subcontractors. Subcontractors should also use those same reasonable efforts in employment and subcontracting efforts.

i. Obligation to report violations by subcontractors. According to several respondents, prime contractors should not be responsible for oversight of their subcontractors and should not be subject to debarment for failure of a subcontractor to meet the requirement of the rule. The respondents were concerned that the rule renders prime contractors police for their subcontractors which respondents consider unreasonable and burdensome. One respondent was also concerned that rule creates a contractual obligation on the part of the contractor to ensure that its subcontractors perform as required by the rule. Another respondent stated that the rule fails to define the obligation of the contractor to police its subcontractors with regard to the required compliance program and integrity reporting. It is unclear what degree of due diligence the Government expects of the contractor.

Response: There is no requirement for the contractor to review or approve its subcontractors' ethics codes or internal control systems. Verification of the existence of such code and program can be part of the standard oversight that a contractor exercises over its subcontractors. The prime contractor is subject to debarment only if it fails to disclose known violations by the subcontractor. Therefore, a change to the rule is not necessary.

ii. Disclosure through the prime contractor. One respondent was concerned that the rule mandates that the disclosures go directly to the Government and not through the prime contractor. DoJ was concerned that some subcontractors may not be comfortable making disclosure through the prime contractor and suggested that a mechanism through which a subcontractor makes a disclosure be addressed in the final rule.

Response: The clause flow down in paragraph (d)(2) states that in altering the clause to identify the appropriate parties, all disclosures of violations of the civil FCA or of Federal criminal law shall be directed to the agency OIG, with a copy to the contracting officer. The clause does not require disclosure through the prime contractor.

iii. Liability for erroneous disclosure. One respondent was concerned that the rule creates a potential significant liability for the contractor if disclosures concerning subcontractors turn out to be in error. The respondent requested the Councils to consider whether damages assessed against contractors for erroneous reports would be allowable costs. Also, the respondent was concerned that the rule is unclear about the disclosure of criminal violations by subcontractors, and suggests that the Councils revise the rule to make the disclosure requirements for the contractor and the subcontractor parallel.

Response: The Councils revised the rule to require the contractor to disclose credible evidence of a violation of Federal criminal law in connection with the contract or any subcontract under the contract. This revision provides to the contractor sufficient opportunity to take reasonable steps to determine the credibility of any possible disclosure prior to disclosing it to the agency Inspector General and contracting officer. The potential for erroneous disclosure is minimized by requiring the contractor to disclose only credible evidence of violations, thereby reducing the contractor's potential liability for damages associated with erroneously disclosing alleged violations which are not substantiated.

c. Small Businesses (See Also Paragraph 11. “Regulatory Flexibility Act Concerns”, for Comments on Initial Regulatory Flexibility Analysis)

i. Support level of applicability to small businesses. An agency OIG supported the application of the basic requirements of the rule to small business because the rule avoids imposing unnecessary burdens on small businesses by creating expensive paperwork requirements. Likewise, another agency OIG considered the exemption for small business contractors (from the requirements for a formal internal control system) reasonable. Another agency OIG also indicated that undesirable results for small business which could have resulted from initial drafts of the rule have been mediated by this rule.

Response: Concur.

ii. Overly burdensome on small business: One respondent believed that the rule is an overly burdensome and unrealistic policing requirement that imposes significant new cost requirements and is particularly burdensome for small businesses; effectively precluding such businesses from competing for prime contract work or as a high-tier subcontractor.

• Response: Although the rule may have a significant economic impact on a substantial number of small entities with respect to the disclosure requirement, the rule is structured to minimize its impact on small business concerns by making the requirement for formal training programs and internal control systems inapplicable to small businesses, and limiting the disclosure requirement of violations of Federal criminal law to those violations involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code, although the rule did add the reporting of violations of the False Claims Act. The Councils do not believe that a change to the rule is necessary.

d. Dollar Threshold or Minimum 120 Day Performance Period

i. Recommend no threshold and no minimum performance period. One agency OIG commented on the rule's threshold of $5 million and 120-day performance period. The agency OIG believed that the application of the rule should not be determined on the basis of the dollar value or the period of performance of the contract. The respondent was concerned that, at times, contracting officers have awarded smaller dollar value contracts or modifications instead of one large dollar contract to circumvent various thresholds that trigger requirements. The respondent believed that the public and members of Congress have similar expectations of all contractors no matter the contract value or type.

Response: The Close the Contractor Fraud Loophole Act (Pub. L. 110-252, Section 6103) now defines a covered contract for application of this regulation as any contract in an amount greater than $5 million and more than 120 days in duration. The Councils also note that, regardless of whether the clause is included in the contract, the suspension and debarment provisions in Subpart 9.4 apply to all contractors, regardless of contract value or duration.

ii. Applicability of thresholds to Federal Supply Schedule (FSS) contracts and Blanket Purchase Agreements (BPA). One respondent requests explanation of the applicability of the thresholds to FSS contracts. The respondent does not believe that FAR 1.108(c) adequately clarifies the issue. Are the thresholds based on each individual order?

Response: According to FAR 1.108(c), unless otherwise specified, if the action establishes a maximum quantity of supplies or services to be acquired, the final anticipated dollar value must be the highest final priced alternative to the Government, including the dollar value of all options. That is, if it is anticipated that the dollar value of orders on an FSS contract will exceed $5 million, then this clause is included in the basic contract against which orders are placed.

e. Single Government Standard Also Applicable to Grants

One respondent was concerned that multiple Federal agencies already have compliance guidelines and regulations in place, or in development, and believes the rule may be inconsistent with other Federal agency requirements. The respondent requested that a single Federal Government-wide standard be created to foster integrity and honesty that applies to both Government contracts and Federal grants.

Response: The Councils acknowledge the respondent's concern. However, this rule establishes a Government-wide standard for contractor compliance programs and integrity reporting with respect to Government contract awards. Under the rule, all Federal agencies will be required to implement the same requirements in the same manner consistent with the award of Federal contracts. However, the rule does not and is not intended to address contractor compliance programs and integrity reporting with respect to agency grant-making procedures. Given the legal differences between a grant and a contract that concern performance and termination for default, the creation of a single Government standard addressing contractor compliance programs and integrity reporting is not practical and is outside the scope of the rule.

10. Additional Recommendations

a. Defer Final Rule Until

i. More experience with 2006-007. One respondent suggested that the FAR Council evaluate experience with the final rule, before proposing changes. The FAR Council should withdraw the proposed rule in favor of allowing covered contractors to implement the November 23, 2007, final rule.

ii. Completion of the National Science and Technology Council initiative. Several respondents urged the FAR Council to defer further action on proposed FAR Case 2007-006 pending completion of the National Science and Technology Council (NSTC) initiative to develop compliance guidance for recipients of Federal research funding from all agencies across the Federal Government.

iii. Further action on related legislation that would expand the scope of the civil FCA. One respondent requests postponement until after enactment of pending legislation on the civil FCA.

iv. Public hearings. One respondent alternatively suggests additional public comment in light of the pertinent intervening legislation and public hearings.

Response: The intervening legislation requires implementation of this rule in the FAR within 180 days of enactment of Pub. L. 110-252 (by December 26, 2008). Therefore, the Councils will proceed with this rule without delay.

At the time of publishing the final rule (2006-007), the proposed rule (2007-006) under this case had already been published. The preamble of the final rule under 2006-007 stated the intent to address mandatory disclosure and full cooperation under the follow-on rule.

It is unknown when the NSTC initiative to develop compliance guidance for recipients of Federal research funding from all agencies across the Federal Government will be completed. The Councils do not agree to delay the FAR rule pending the outcome of this particular initiative. Often the regulations for grants use the FAR as a model.

b. Expand Policy and Clause to Cover Overpayments

DoJ and an agency IG commented that the drafters of the proposed rule neglected to incorporate “knowing failure to timely disclose an overpayment” in the first reference at 3.1002(c).

Several respondents proposed that the language in the proposed FAR clause be expanded to also include instances of overpayment. More inclusive language removes any ambiguity (and loopholes) about what should be revealed to the Government. By expanding the scope to include overpayments, contractors are no longer asked to label (or mislabel) their activity as “criminal”. In the opinion of the respondents, the proposed rule does not match the stated objective of encouraging Government notification of fraud and overpayments.

Response: The mandatory reporting of overpayments is addressed in the Payments clauses. However, to aid in clarity, we have added a cross reference at FAR 3.1003 to the Payment clauses and the knowing failure to timely disclose significant overpayments as a cause for suspension/debarment in FAR Subpart 9.4.

c. Create a Contractor Integrity and Business Ethics Information Section in FAR Part 42

One respondent urged the FAR Councils to create a contractor integrity and business ethics section in FAR Part 42 that would require Government officials to record and maintain integrity and business ethics information that can be shared with Government officials. Although contractor performance and responsibility are part of FAR Subpart 9.1, the respondent requests that distinctive data and information be collected on each.

Another respondent, on the other hand, is very satisfied that the rule only proposed one change to the contractor past performance information in FAR 42.1501, and properly reinforces the existing emphasis on contractor cooperation across a broad range of contract administration matters, including cooperation with investigations.

Response: The proposed rule has added a cross reference in Part 42 to promote the inclusion of business integrity in past performance. The request to collect distinctive data and information on contractor responsibility is outside the scope of this rule. The past performance databases are controlled by the agencies. (See also response to “Suspension/Debarment”, paragraph B.5.g. “Blacklisting”)

d. Add Safety Issues

An agency IG suggested that safety issues should be included in the mandatory disclosure requirement.

Response: Adding explicit coverage of safety issues is outside the scope of this case.

e. Protection of Contractor Disclosures

The proposed rule states at 3.1002 (Policy) that contractors should have an internal control system that facilitates timely discovery of improper conduct in connection with Government contracts. A contractor may be suspended or debarred for knowing failure to timely disclose a violation of Federal criminal law in connection with the award or performance of any Government contract performed by the contractor.

DoJ suggested that, in order to encourage contractors to submit information, the Councils may wish to recommend to agencies that the submitted information be maintained confidentially to the extent permitted by law and that any disclosure of the information under FOIA should only be made after full consideration of institutional, commercial, and personal privacy interests that could be implicated by such a disclosure. In particular, agencies should be mindful that the Trade Secrets Act operates as a prohibition on the discretionary disclosure of any information covered by Exemption 4 of the FOIA, unless disclosure is otherwise authorized by law.

Response: The Councils have added the following provision to the final rule, similar to the provision employed by the DoD Voluntary Disclosure Program (DoD Directive 5106.01, April 23, 2006) in “XYZ” agreements with contractors pursuant to DoD Voluntary Disclosure Program Guidance (IGD 5505.50, CIPO, April 1990) (see http://www.dodig.mil/​Inspections/​vdprogram.htm): “The Government, to the extent permitted by law and regulation, will safeguard and treat information obtained pursuant to the contractor's disclosure as confidential where the information has been marked “confidential” or “proprietary” by the company. To the extent permitted by law and regulation, such information will not be released by the Government to the public pursuant to a Freedom of Information Act request, 5 U.S.C. section 552, et. seq., without prior notification to the contractor. The Government may transfer documents provided by the contractor to any department or agency within the Executive Branch if the information relates to matters within the organization's jurisdiction.”

The addition of the above provision will provide appropriate assurance to contractors about the Government's protection afforded to disclosures.

11. Regulatory Flexibility Act concerns

a. IRFA Does Not Identify a Rational Basis for the Rule

Several respondents criticized the Initial Regulatory Flexibility Analysis (IRFA) as deficient because they believe that it does not identify a rational basis for the rule. They claim that there is no empirical or anecdotal evidence to explain why the mandatory disclosure requirement is required for the proper functioning of the procurement system.

Response: See response to “Mandatory disclosure to the OIG”, “Empirical support that mandatory disclosure will achieve the Councils' objective”, at paragraph B.3.a.iii. d.

b. The IRFA Underestimates the Number of Small Businesses Affected and the Associated Costs

Several respondents also considered that the IRFA underestimates the number of small businesses affected, as it only describes the estimated 28 small businesses which conclude that disclosure is required, rather than the larger number which will have to conduct internal investigations before concluding that disclosure is not required. One respondent pointed out the costs to run a compliance program. Another respondent pointed out that the IRFA does not ascertain the costs when a company chooses to retain outside counsel to investigate, which could range from $1 million to $20 million. The rule will cost small businesses over $1 billion a year (calculation—for each report there would be 5 internal investigations at a cost of $5 million per contractor and $2.5 million per subcontractor.)

Response: First, the IRFA estimated an impact on 45 small businesses, not just the 28 covered by the clause.

Second, an ethical company that learns that an employee may have committed a violation of Federal criminal law would not ignore this information. A company would normally investigate allegations of wrongdoing within the company as a sound business practice. If there was clearly no violation, the investigation would be short. Although the rule allows contractors time to take reasonable steps to determine that evidence of wrongdoing is credible, it does not direct contractors to carry out any particular level of internal investigation. The IRFA focused on the effort which results from this rule—disclosure to the Government—although there are other incentives outside this rule which could cause a contractor to voluntarily disclose violations to the Government, such as the U.S. Sentencing Guidelines. Although the IRFA does not include the cost of the investigation in its calculations, the FAR does not require or envision a small business paying millions of dollars for an investigation. The respondent's calculated cost estimates are not supported or credible.

The FAR did give relief for the costs of running a compliance program by leaving it to the discretion of the small business and paragraph (c) of the clause is not mandatory for small businesses.

c. Imposition of Suspension and Debarment Will Disproportionately Damage Small Businesses

One respondent stated that small businesses do not have the resources that large businesses do. They do not have the resources to institute compliance programs. They are more likely to be caught in the suspension and debarment process. They lack the leverage to negotiate agreements in lieu of debarment. Therefore, the rule's reliance on suspension and debarment as an enforcement mechanism will disproportionately damage small businesses.

Response: The Councils agree that small businesses often have fewer resources than other than small business. Nonetheless, the Councils cannot give further flexibility here. The Councils have already eliminated the requirement for the internal control system for small businesses. The Councils cannot establish a different suspension or debarment standard for small businesses.

d. Estimate of Small Businesses That Would Disclose if No Mandatory Requirement

One respondent quoted the IRFA as estimating that, in the absence of the proposed disclosure requirement, 1 percent of small business contractors that are aware of a violation would voluntarily report it. This suggests, according to the respondent, that the FAR Council believes that mandatory disclosure would lead to a 100-fold increase in the number of reported violations. The respondent states that there is no support for this estimate and no rational basis to support a claim that this disclosure requirement is needed for the effective functioning of the procurement system.

Response: The respondent has drawn an unwarranted conclusion about the estimated impact of mandatory disclosure. The estimated 1% disclosure rate in the IRFA is for small businesses that do not have the clause in their contract (i.e., small dollar value or short performance period). There was no estimate in the IRFA about what percentage of this population would disclose if the clause were included. Further, any estimates about this segment of the population cannot be extrapolated to a conclusion about the effect of mandatory disclosure requirements on higher dollar value, noncommercial contracts or contracts with large businesses.

e. Recordkeeping Requirements

One respondent objected that the IRFA did not provide a full discussion of the projected recordkeeping and compliance requirements. Good business sense will require a contractor to develop and keep more records for the purpose of documenting its investigation.

Response: The Councils agree that recordkeeping would be wise, but the rule does not require recordkeeping beyond the recordkeeping that would be part of the contractor's normal business practices. Under 5 U.S.C. 601, the term “recordkeeping requirement” is defined as a requirement imposed by an agency on persons to maintain specified records.

f. Duplication, Overlap, or Conflict

Several respondents criticized the statement in the IRFA that the rule does not duplicate, overlap, or conflict with any other Federal rules. The respondents state that the IRFA—

• Ignored the obvious interrelationship with the civil Federal civil FCA and its qui tam provisions;
• Did not address the inconsistency between the proposed rule and the Federal Sentencing Guidelines; and
• Did not address that the rule is inconsistent with a voluntary disclosure being a mitigation consideration in the FAR debarment and suspension proceedings and under the civil FCA because disclosure would be mandatory rather than voluntary.

Response: Under 5 U.S.C. 601, “rule” is defined as meaning “any rule for which the agency publishes a general notice of proposed rulemaking pursuant to section 553(b) of this title or any other law * * * ”. Codified laws are not a rule. The Sentencing Guidelines are, strictly speaking, also not a rule. However, the Councils disagree that this rule is duplicative of the civil FCA. Any inadvertent inconsistency with the Guidelines has been considered in formulating this final rule.

Regarding mitigation and voluntary disclosure, see “Mandatory disclosure to the OIG”, “Incentives” at paragraph B.3.a.vi.

12. Paperwork Reduction Act (PRA)

a. Burden Underestimated

One respondent stated that the Councils' Paperwork Reduction Act analysis is inadequate. The estimates are so conservative as to be unrealistic. If it only takes 20 hours to conduct pre-disclosure review and draft a corresponding report, why does it take the Government a year to decide whether to intervene in a traditional qui tam case? The respondent points out that “burden” includes all aspects of the reporting process, including the separation of reportable events from non-reportable events.

Another respondent also considers the estimated burden of 3 hours per report woefully inadequate, considering the time needed by respondents to investigate and determine whether a civil FCA violation or criminal violation occurred.

Response: Burden includes estimated hours only for those actions which a company would not undertake in the normal course of business. The Government does not direct companies to investigate. In the normal course of business, a company that is concerned about ethical behavior will take reasonable steps to determine the credibility of allegations of misconduct within the firm. It is left to the discretion of the company what these reasonable steps may entail. The Government has added the requirement to disclose to the Government when credible evidence of misconduct is obtained, which would not necessarily otherwise occur. The estimated hours in the regulatory flexibility analysis and the paperwork burden act analysis are to cover the hours required for preparing and reviewing the disclosure to the Government when credible evidence has been obtained. The estimated hours must also be viewed as an average between the hours that a simple disclosure by a very small business might require and the much higher numbers that might be required for a very complex disclosure by a major corporation. However, upon further discussion with subject matter experts, the Councils have revised the estimated hours to 60 hours per response, considering particularly the hours that would be required for review within the company, prior to release to the Government.

b. Recordkeeping and Other Compliance Requirements

One respondent stated that the projected recordkeeping and compliance requirements are far more burdensome than reflected in the IRFA. The contractor must keep and maintain extensive records any time it investigates allegations or suspicions of violations. Even if a company determines that disclosure is not required, the contractor must keep records of its decision-making process in order to defend against possible future accusations of failure to disclose.

Another respondent states that time is required for 1400 covered contractors to establish systems for complying with this regulation.

Response: See the response in previous section on Regulatory Flexibility Analysis (B.11.).

c. Data and Methodology Should Be Made Part of the Rulemaking Record

Response: The public can request copies of the supporting statements.

13. Executive Order 12866

a. Significant Rule

A number of respondents are concerned that this rule is a significant rule in accordance with E.O. 12866 section 3.(f). One respondent is concerned that, by extending the rule to cover commercial acquisitions and overseas contracts, a review requirement as a “major rule” or a significant rule under section 3.(f)(1) may have been unintentionally triggered. Another respondent believes that the rule should have a cost-benefit analysis.

One respondent states that the addition of violations of the civil FCA as a ground for mandatory disclosure is sufficient standing alone to trigger review under Section 6(b) of E.O. 12866.

Another respondent submits that this is a significant regulatory action because it will, among other things, adversely affect in a material way a sector of the economy (Government contractors).

Several respondents also state that the second proposed rule raises important legal and policy issues, another grounds for the Office of Information and Regulatory Affairs (OIRA) to declare a rule significant under E.O. 12866, under section 3.(f)(4).

One respondent suggests that it was a Freudian slip when the FR notice for the first proposed rule stated that the first proposed rule was a significant regulatory action and therefore was not subject to review.

Response: The first proposed rule was declared to be a significant rule by OIRA. The typographical error was in the second half of the sentence, not the first. The rule was subject to review under the Executive order and was so reviewed. OIRA did not declare the second proposed rule to be a significant rule.

All rules are sent through the Office of Information and Regulatory Affairs for determination as to whether the rule is significant. OMB's Office of Information and Regulatory Affairs has determined this is a significant rule, and not a major rule.

b. Violates E.O. 12866

One respondent states that the proposed rule violates the E.O. 12866 requirement that rules be “consistent, sensible, and understandable” and that agencies promulgate only such regulations as are required by law, are necessary to interpret the law, or are made necessary by compelling public need. This respondent submits that just because DoJ wants to make its job easier is not sufficient grounds for rulemaking.

Response: This rule is required by law and by compelling public need. The Councils have made every effort to make the draft final rule consistent, sensible, and understandable.

This is a significant regulatory action and, therefore, was subject to review under Section 6(b) of Executive Order 12866, Regulatory Planning and Review, dated September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.

C. Regulatory Flexibility Act

The Regulatory Flexibility Act, 5 U.S.C. 601, et seq., applies to this final rule. The Councils prepared a Final Regulatory Flexibility Analysis (FRFA), and it is summarized as follows:

1. Statement of the need for, and objectives of, the rule.

This rule amends the Federal Acquisition Regulation to require Government contractors to—

• Establish and maintain specific internal controls to detect and prevent improper conduct in connection with the award or performance of any Government contract or subcontract; and
• Notify without delay the agency Office of the Inspector General, with a copy to the contracting officer, whenever, in connection with the award, performance, or closeout of a Government contract awarded to the contractor or a subcontract awarded thereunder, the contractor has credible evidence of a violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in 18 U.S.C. or a violation of the civil False Claims Act.

This case is in response to a request to the Office of Federal Procurement Policy from the Department of Justice and Public Law 110-252. Based on the requirements of Pub. L. 110-252, the rule was expanded to include the clause 52.203-13 in contracts performed overseas and contracts for the acquisition of commercial items.

The objective of the rule is to emphasize the critical importance of integrity in contracting and reduce the occurrence of improper or criminal conduct in connection with the award and performance of Federal contracts and subcontracts.

2. Summary of the significant issues raised by the public comments in response to the initial regulatory flexibility analysis, a summary of the assessment of the agency of such issues, and a statement of any changes made in the proposed rule as a result of such comments.

a. IRFA does not identify a rational basis for the rule. Several respondents criticized the Initial Regulatory Flexibility Analysis (IRFA) as deficient because they believe that it does not identify a rational basis for the rule. They claim that there is no empirical or anecdotal evidence to explain why the mandatory disclosure requirement is required for the proper functioning of the procurement system.

Response: DoJ and various OIGs provided testimony that the experience with the National Reconnaissance Organization mandatory disclosure clause has been positive. Further, enactment of the Close the Contractor Fraud Loophole Act (Pub. L. 110-252, Sec VI, Chapter 1) now mandates many of these revisions to the FAR.

b. The IRFA underestimates the number of small businesses affected and the associated costs. Some respondents considered that the IRFA underestimates the number of small businesses affected, as it only describes the estimated 28 small businesses which conclude that disclosure is required, rather than the larger number which will have to conduct internal investigations before concluding that disclosure is not required. Respondents pointed out the costs to run a compliance program and that the IRFA does not ascertain the costs when a company chooses to retain outside counsel to investigate, which could range from $1 million to $20 million. The rule will cost small businesses over $1 billion a year (calculation—for each report there would be 5 internal investigations at a cost of $5 million per contractor and $2.5 million per subcontractor).

Response: First, the IRFA estimated an impact on 45 small businesses, not just the 28 covered by the clause. Further, an ethical company that finds out an employee may have committed a violation of Federal criminal law would not ignore this. A company would normally follow up allegations of wrongdoing within the company as a sound business practice. If there was clearly no violation, the investigation would be short. Although the rule allows contractors time to take reasonable steps to determine that evidence of wrongdoing is credible, it does not direct contractors to carry out any particular level of internal investigation. The IRFA focused on the effort which results from this rule—reporting to the Government. Although there are other incentives outside this rule which could cause a contractor to voluntarily disclose violations to the Government, such as the U.S. Sentencing Guidelines. Although the IRFA does not include the cost of the investigation in its calculations, the FAR does not require or envision a small business paying millions of dollars for an investigation. The respondent's calculated cost estimates are not supported or credible.

The FAR did give relief for the costs of running a compliance program by leaving it to the discretion of the small business; paragraph (c) of the clause is not mandatory for small businesses.

c. Imposition of suspension and debarment will disproportionately damage small businesses. A respondent stated that small businesses don't have the resources that large businesses do. They do not have the resources to institute compliance programs. They are more likely to be caught in the suspension and debarment process. They lack the leverage to negotiate agreements in lieu of debarment. Therefore, the rule's reliance on suspension and debarment as an enforcement mechanism will disproportionately damage small businesses.

Response: The Councils agree that small businesses have fewer resources than other than small businesses. Nonetheless, the Councils cannot give further flexibility here. The Councils have already eliminated the requirement for the internal control system for small businesses. The Councils cannot establish a different suspension or debarment standard for small businesses.

d. Estimate of small businesses that would report if no mandatory requirement. One respondent quoted the IRFA as estimating that, in the absence of the proposed disclosure requirement, 1% of small business contractors that are aware of a violation would voluntarily report it. This suggests, according to the respondent, that the FAR Council believes that mandatory disclosure would lead to a 100 fold increase in the number of reported violations. The respondent states that there is no support for this estimate.

Response: The respondent has drawn an unwarranted conclusion about the estimated impact of mandatory disclosure. The estimated 1% disclosure rate in the IRFA is for small businesses that do not have the clause in their contract (i.e., small dollar value or short performance period). There was no estimate in the IRFA about what percentage of this population would report if the clause were included. Further, any estimates about this segment of the population cannot be extrapolated to a conclusion about the effect of mandatory disclosure requirements on higher dollar value contracts of duration more that 120 days or contracts with large businesses. The number of small businesses affected cannot be known exactly because there is no data at this time on disclosures that will result from this rule, but the numbers represent the best estimate of subject matter experts in the Government.

e. Recordkeeping requirements. One respondent objected that the IRFA did not provide a full discussion of the projected recordkeeping and compliance requirements. Good business sense will require a contractor to develop and keep more records for the purpose of documenting its investigation.

Response: Although recordkeeping would be wise, the rule does not require it. Under 5 U.S.C. 601, the term “recordkeeping requirement” is defined as a requirement imposed by an agency on persons to maintain specified records.

f. Duplication, overlap, or conflict. Several respondents criticized the statement in the IRFA that the rule does not duplicate, overlap, or conflict with any other Federal rules. The respondents state that the IRFA ignores the obvious interrelationship with the Federal False Claims Act and its qui tam provisions and it did not address the inconsistency between the proposed rule and the Federal Sentencing Guidelines. The rule is inconsistent with a voluntary disclosure being a mitigation consideration in the FAR debarment and suspension proceedings and under the False Claims Act because disclosure would be mandatory rather than voluntary.

Response: Under 5 U.S.C. 601, “rule” is defined as meaning any rule for which the agency publishes a general notice of proposed rulemaking pursuant to section 553(b) of this title. Codified laws are not a rule. The Sentencing Guidelines are, strictly speaking, also not a rule. However, the Councils disagree that this rule is duplicative of the False Claims Act and any inadvertent inconsistency with the Guidelines has been considered in formulating this final rule. The FAR, the U.S. Sentencing Guidelines, and the civil False Claims Act consider any self-disclosure to constitute a mitigating circumstance, whether voluntary or mandatory.

3. Description and estimate of the number of small entities to which the rule will apply.

The rule imposes a clause in contracts that exceed $5 million and a performance period greater than 120 days. Based on FY 2006 data collected from the Federal Procurement Data System, the Councils estimate that this clause will apply to 2700 prime contractors per year, of which 1050 companies are small business concerns.

The clause also flows down to subcontracts that exceed $5 million, and we estimate that approximately 1050 additional small business concerns will meet these conditions. We calculate the number of small business concerns that will be required by the clause to report violations of Federal criminal law with regard to a Government contract or subcontracts as follows:

1050 prime contractors + 1050 subcontractors = 2100 × 4% = 84.

In addition, although there is no clause required, all contractors will be on notice that they may be suspended or debarred for failure to report known violations of Federal criminal law with regard to a Government contract or subcontract. In FY 2006 there were 144,854 small business concerns listed in FPDS-NG with unique DUNS numbers. We estimate that of the listed small business concerns, approximately 116,000 (80%) will receive contracts in a given fiscal year. Government small business experts guess that at least twice that number of small businesses (232,000) will receive subcontracts. However, the only small business concerns impacted by this cause for suspension or debarment are those that are aware of violation of Federal criminal law with regard to their Government contracts or subcontracts. Subtracting out those contracts and subcontracts covered by the clause (1050 each), we estimate this number as follows: (114,950 + 230,950 = 345,900 × 1% = 3,459). We estimate a lower percentage than used for contracts and subcontracts that contain the clause, because these are lower dollar contracts and subcontracts, including commercial contracts, and there may be less visibility into violations of Federal criminal law. Because there is no contract clause, we estimate that only 1% of those contractors/subcontractors that are aware of a violation of Federal criminal law in regard to the contract or subcontract will voluntarily report such violation to the contracting officer (3459 × 1% = 34). The estimated number of small businesses in the FRFA (119) has increased from the IRFA (45) because of the applicability of the clause to commercial contracts and contracts to be performed outside the United States and because the disclosure requirement now applies to violations of the civil False Claims Act as well as violations of Federal criminal law.

4. Description of projected reporting, recordkeeping, and other compliance requirements of the rule, including an estimate of the classes of small entities which will be subject to the requirement and the type of professional skills necessary for preparation of the report or record.

The rule requires contractors to report to the agency office of the inspector general, with a copy to the contracting officer, violations of Federal criminal law in connection with the award or performance of any Government contract or subcontract for contracts that exceed $5 million with a contract performance period greater than 120 days, and the same criteria for flow down to subcontracts. Such a report would probably be prepared by company management, and would probably involve legal assistance to prepare and careful review at several levels. There are no recordkeeping requirements in the rule.

5. Description of the steps the agency has taken to minimize the significant economic impact on small entities consistent with the state objectives of applicable statute, including a statement of the factual, policy, and legal reasons for selecting the alternative adopted in the final rule and why each one of the other significant alternatives to the rule considered by the agency which affect the impact on small entities was rejected.

The Councils adopted the following alternatives in order to minimize the impact on small business concerns:

• The final rule requires small businesses to “make a copy of the code available” to each employee (rather than “provide a copy”). The Councils rejected the addition of a requirement that small businesses must specifically make each employee aware of the duties and obligations under the code.
• The requirement for formal training programs and internal control systems is inapplicable to small business concerns. Large businesses are still required to have an ongoing business ethics and conduct awareness and compliance program
• Disclosure of violations of criminal law is limited to violations of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in 18 U.S.C., rather than any violation of criminal law.
• The violations that must be disclosed do not include violations under the contracts of other contractors.
• The period of occurrence of violations that must be disclosed is limited to 3 years after contract closeout, rather than extending indefinitely.

The Councils could not exclude small businesses that provide commercial items, because Pub. L. 110-252 requires application to contracts for the acquisition of commercial items.

The Councils decided to require disclosure of violations of civil False Claims Act (from both large and small businesses), as requested by the Department of Justice, because to achieve the objectives of this rule, it is crucial to deal with responsible contractors, whether large or small. It is not necessarily evident at the beginning of an investigation whether an incident is simply an overpayment, a civil false claim, or a criminal violation. There is no rational reason to exclude civil false claims from the mandatory disclosure requirement.

Interested parties may obtain a copy of the FRFA from the FAR Secretariat. The FAR Secretariat has submitted a copy of the FRFA to the Chief Counsel for Advocacy of the Small Business Administration.

D. Paperwork Reduction Act

The Paperwork Reduction Act (44 U.S.C. Chapter 35) applies because the final rule contains an information collection requirement (ICR). The clause at 52.203-13 requires the Contractor to disclose “credible evidence of a violation” of Federal criminal law or a violation of the False Claims Act, involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code. We received one comment from the public on this disclosure requirement. Based on the comment that the Government's estimated burden of 3 hours per response was inadequate, the Councils have revised the estimated burden hours to 60 hours per response. This change particularly considers the hours that would be required for review of the collection within a company, prior to release to the Government. Based on the revised estimated burden of 60 hours per response, the annual reporting burden is revised as follows:

Respondents:	284
Responses per respondent:	×   1
Total annual responses:	284
Preparation hours per response:	×   60
Total response burden hours:	17,040
Averages wages ($75 + 32.85% OH):	×   $100
Estimated cost to the Public:	$1,704,000

Accordingly, the FAR Secretariat has forwarded a request for approval of a new information collection requirement concerning 9000-00XX to the Office of Management and Budget under 44 U.S.C. 3501, et seq.

List of Subjects in 48 CFR Parts 2, 3, 9, 42 and 52

• Government procurement

Al Matera,

Director, Office of Acquisition Policy.

Therefore, DoD, GSA, and NASA amend 48 CFR parts 2, 3, 9, 42 and 52 as set forth below:

1. The authority citation for 48 CFR parts 2, 3, 9, 42 and 52 continues to read as follows:

Authority: 40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 42 U.S.C. 2473(c).

PART 2—DEFINITIONS OF WORDS AND TERMS

2. Amend section 2.101 in paragraph (b)(2) by adding, in alphabetical order, the definition “Principal” to read as follows:

2.101

Definitions.

* * * * *

(b) * * *

(2) * * *

Principal means an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager; head of a subsidiary, division, or business segment; and similar positions).

* * * * *

PART 3—IMPROPER BUSINESS PRACTICES AND PERSONAL CONFLICTS OF INTEREST

3. Revise section 3.1001 to read as follows:

3.1001

Definitions.

As used in this subpart—

Subcontract means any contract entered into by a subcontractor to furnish supplies or services for performance of a prime contract or a subcontract.

Subcontractor means any supplier, distributor, vendor, or firm that furnished supplies or services to or for a prime contractor or another subcontractor.

United States means the 50 States, the District of Columbia, and outlying areas.

4. Amend section 3.1003 by revising the section heading and paragraph (a); redesignating paragraph (b) as paragraph (c), and adding a new paragraph (b) to read as follows:

3.1003

Requirements.

(a) Contractor requirements. (1) Although the policy at 3.1002 applies as guidance to all Government contractors, the contractual requirements set forth in the clauses at 52.203-13, Contractor Code of Business Ethics and Conduct, and 52.203-14, Display of Hotline Poster(s), are mandatory if the contracts meet the conditions specified in the clause prescriptions at 3.1004.

(2) Whether or not the clause at 52.203-13 is applicable, a contractor may be suspended and/or debarred for knowing failure by a principal to timely disclose to the Government, in connection with the award, performance, or closeout of a Government contract performed by the contractor or a subcontract awarded thereunder, credible evidence of a violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code or a violation of the civil False Claims Act. Knowing failure to timely disclose credible evidence of any of the above violations remains a cause for suspension and/or debarment until 3 years after final payment on a contract (see 9.406-2(b)(1)(vi) and 9.407-2(a)(8)).

(3) The Payment clauses at FAR 52.212-4(i)(5), 52.232-25(d), 52.232-26(c), and 52.232-27(l) require that, if the contractor becomes aware that the Government has overpaid on a contract financing or invoice payment, the contractor shall remit the overpayment amount to the Government. A contractor may be suspended and/or debarred for knowing failure by a principal to timely disclose credible evidence of a significant overpayment, other than overpayments resulting from contract financing payments as defined in 32.001 (see 9.406-2(b)(1)(vi) and 9.407-2(a)(8)).

(b) Notification of possible contractor violation. If the contracting officer is notified of possible contractor violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 U.S.C.; or a violation of the civil False Claims Act, the contracting officer shall—

(1) Coordinate the matter with the agency Office of the Inspector General; or

(2) Take action in accordance with agency procedures.

* * * * *

5. Amend section 3.1004 by removing the introductory text and revising the introductory text of paragraph (b)(1) to read as follows:

3.1004

Contract clauses.

* * * * *

(b)(1) Unless the contract is for the acquisition of a commercial item or will be performed entirely outside the United States, insert the clause at FAR 52.203-14, Display of Hotline Poster(s), if—

* * * * *

PART 9—CONTRACTOR QUALIFICATIONS

6. Amend section 9.104-1 by revising paragraph (d) to read as follows:

9.104-1

General standards.

* * * * *

(d) Have a satisfactory record of integrity and business ethics (for example, see Subpart 42.15).

* * * * *

7. Amend section 9.406-2 by revising the introductory text of paragraph (b)(1) and adding paragraph (b)(1)(vi) to read as follows:

9.406-2

Causes for debarment.

(b)(1) A contractor, based upon a preponderance of the evidence, for any of the following—

* * * * *

(vi) Knowing failure by a principal, until 3 years after final payment on any Government contract awarded to the contractor, to timely disclose to the Government, in connection with the award, performance, or closeout of the contract or a subcontract thereunder, credible evidence of—

(A) Violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code;

(B) Violation of the civil False Claims Act (31 U.S.C. 3729-3733); or

(C) Significant overpayment(s) on the contract, other than overpayments resulting from contract financing payments as defined in 32.001.

* * * * *

8. Revise section 9.407-2 by redesignating paragraph (a)(8) as paragraph (a)(9) and adding a new paragraph (a)(8); to read as follows:

9.407-2

Causes for suspension.

(a) * * *

(8) Knowing failure by a principal, until 3 years after final payment on any Government contract awarded to the contractor, to timely disclose to the Government, in connection with the award, performance, or closeout of the contract or a subcontract thereunder, credible evidence of—

(i) Violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code;

(ii) Violation of the civil False Claims Act (31 U.S.C. 3729-3733); or

(iii) Significant overpayment(s) on the contract, other than overpayments resulting from contract financing payments as defined in 32.001; or

* * * * *

PART 42—CONTRACT ADMINISTRATION AND AUDIT SERVICES

9. Amend section 42.1501 by revising the last sentence to read as follows:

42.1501

General.

* * * It includes, for example, the contractor's record of conforming to contract requirements and to standards of good workmanship; the contractor's record of forecasting and controlling costs; the contractor's adherence to contract schedules, including the administrative aspects of performance; the contractor's history of reasonable and cooperative behavior and commitment to customer satisfaction; the contractor's record of integrity and business ethics, and generally, the contractor's business-like concern for the interest of the customer.

PART 52—SOLICITATION PROVISIONS AND CONTRACT CLAUSES

10. Amend section 52.203-13 by—

a. Revising the date of clause;

b. Revising paragraph (a);

c. Revising paragraphs (b)(1)(i), (b)(1)(ii), (b)(2) and adding paragraph (b)(3); and

d. Revising paragraphs (c) and (d).

The revised text reads as follows:

52.203-13

Contractor Code of Business Ethics and Conduct.

* * * * *

Contractor Code of Business Ethics and Conduct

(Dec 2008)

(a) Definitions. As used in this clause—

Agent means any individual, including a director, an officer, an employee, or an independent Contractor, authorized to act on behalf of the organization.

Full cooperation—(1) Means disclosure to the Government of the information sufficient for law enforcement to identify the nature and extent of the offense and the individuals responsible for the conduct. It includes providing timely and complete response to Government auditors' and investigators' request for documents and access to employees with information;

(2) Does not foreclose any Contractor rights arising in law, the FAR, or the terms of the contract. It does not require—

(i) A Contractor to waive its attorney-client privilege or the protections afforded by the attorney work product doctrine; or

(ii) Any officer, director, owner, or employee of the Contractor, including a sole proprietor, to waive his or her attorney client privilege or Fifth Amendment rights; and

(3) Does not restrict a Contractor from—

(i) Conducting an internal investigation; or

(ii) Defending a proceeding or dispute arising under the contract or related to a potential or disclosed violation.

Principal means an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager; head of a subsidiary, division, or business segment; and similar positions).

Subcontract means any contract entered into by a subcontractor to furnish supplies or services for performance of a prime contract or a subcontract.

Subcontractor means any supplier, distributor, vendor, or firm that furnished supplies or services to or for a prime contractor or another subcontractor.

United States means the 50 States, the District of Columbia, and outlying areas.

(b) * * *

(1) * * *

(i) Have a written code of business ethics and conduct;

(ii) Make a copy of the code available to each employee engaged in performance of the contract.

(2) The Contractor shall—

(i) Exercise due diligence to prevent and detect criminal conduct; and

(ii) Otherwise promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law.

(3)(i) The Contractor shall timely disclose, in writing, to the agency Office of the Inspector General (OIG), with a copy to the Contracting Officer, whenever, in connection with the award, performance, or closeout of this contract or any subcontract thereunder, the Contractor has credible evidence that a principal, employee, agent, or subcontractor of the Contractor has committed—

(A) A violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code; or

(B) A violation of the civil False Claims Act (31 U.S.C. 3729-3733).

(ii) The Government, to the extent permitted by law and regulation, will safeguard and treat information obtained pursuant to the Contractor's disclosure as confidential where the information has been marked “confidential” or “proprietary” by the company. To the extent permitted by law and regulation, such information will not be released by the Government to the public pursuant to a Freedom of Information Act request, 5 U.S.C. Section 552, without prior notification to the Contractor. The Government may transfer documents provided by the Contractor to any department or agency within the Executive Branch if the information relates to matters within the organization's jurisdiction.

(iii) If the violation relates to an order against a Governmentwide acquisition contract, a multi-agency contract, a multiple-award schedule contract such as the Federal Supply Schedule, or any other procurement instrument intended for use by multiple agencies, the Contractor shall notify the OIG of the ordering agency and the IG of the agency responsible for the basic contract.

(c) Business ethics awareness and compliance program and internal control system. This paragraph (c) does not apply if the Contractor has represented itself as a small business concern pursuant to the award of this contract or if this contract is for the acquisition of a commercial item as defined at FAR 2.101. The Contractor shall establish the following within 90 days after contract award, unless the Contracting Officer establishes a longer time period:

(1) An ongoing business ethics awareness and compliance program.

(i) This program shall include reasonable steps to communicate periodically and in a practical manner the Contractor's standards and procedures and other aspects of the Contractor's business ethics awareness and compliance program and internal control system, by conducting effective training programs and otherwise disseminating information appropriate to an individual's respective roles and responsibilities.

(ii) The training conducted under this program shall be provided to the Contractor's principals and employees, and as appropriate, the Contractor's agents and subcontractors.

(2) An internal control system.

(i) The Contractor's internal control system shall—

(A) Establish standards and procedures to facilitate timely discovery of improper conduct in connection with Government contracts; and

(B) Ensure corrective measures are promptly instituted and carried out.

(ii) At a minimum, the Contractor's internal control system shall provide for the following:

(A) Assignment of responsibility at a sufficiently high level and adequate resources to ensure effectiveness of the business ethics awareness and compliance program and internal control system.

(B) Reasonable efforts not to include an individual as a principal, whom due diligence would have exposed as having engaged in conduct that is in conflict with the Contractor's code of business ethics and conduct.

(C) Periodic reviews of company business practices, procedures, policies, and internal controls for compliance with the Contractor's code of business ethics and conduct and the special requirements of Government contracting, including—

(1) Monitoring and auditing to detect criminal conduct;

(2) Periodic evaluation of the effectiveness of the business ethics awareness and compliance program and internal control system, especially if criminal conduct has been detected; and

(3) Periodic assessment of the risk of criminal conduct, with appropriate steps to design, implement, or modify the business ethics awareness and compliance program and the internal control system as necessary to reduce the risk of criminal conduct identified through this process.

(D) An internal reporting mechanism, such as a hotline, which allows for anonymity or confidentiality, by which employees may report suspected instances of improper conduct, and instructions that encourage employees to make such reports.

(E) Disciplinary action for improper conduct or for failing to take reasonable steps to prevent or detect improper conduct.

(F) Timely disclosure, in writing, to the agency OIG, with a copy to the Contracting Officer, whenever, in connection with the award, performance, or closeout of any Government contract performed by the Contractor or a subcontractor thereunder, the Contractor has credible evidence that a principal, employee, agent, or subcontractor of the Contractor has committed a violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 U.S.C. or a violation of the civil False Claims Act (31 U.S.C. 3729-3733).

(1) If a violation relates to more than one Government contract, the Contractor may make the disclosure to the agency OIG and Contracting Officer responsible for the largest dollar value contract impacted by the violation.

(2) If the violation relates to an order against a Governmentwide acquisition contract, a multi-agency contract, a multiple-award schedule contract such as the Federal Supply Schedule, or any other procurement instrument intended for use by multiple agencies, the contractor shall notify the OIG of the ordering agency and the IG of the agency responsible for the basic contract, and the respective agencies' contracting officers.

(3) The disclosure requirement for an individual contract continues until at least 3 years after final payment on the contract.

(4) The Government will safeguard such disclosures in accordance with paragraph (b)(3)(ii) of this clause.

(G) Full cooperation with any Government agencies responsible for audits, investigations, or corrective actions.

(d) Subcontracts. (1) The Contractor shall include the substance of this clause, including this paragraph (d), in subcontracts that have a value in excess of $5,000,000 and a performance period of more than 120 days.

(2) In altering this clause to identify the appropriate parties, all disclosures of violation of the civil False Claims Act or of Federal criminal law shall be directed to the agency Office of the Inspector General, with a copy to the Contracting Officer.

(End of clause)

11. Amend section 52.209-5 by revising the date of clause; and paragraph (a)(2) to read as follows:

52.209-5

Certification Regarding Responsibility Matters.

* * * * *

Certification Regarding Responsibility Matters

(Dec 2008)

* * * * *

(a) * * *

(2) Principal, for the purposes of this certification, means an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager; head of a subsidiary, division, or business segment; and similar positions).

* * * * *

12. Amend section 52.212-5 by—

a. Revising the date of the clause;

b. Redesignating paragraphs (b)(2) through (b)(40) as (b)(3) through (b)(41), respectively, and adding a new paragraph (b)(2);

c. Removing from paragraph (e)(1) “paragraphs (i) through (vii)” and adding “paragraphs (e)(1)(i) through (xi)” in its place; and.

d. Redesignating paragraphs (e)(1)(i) through (e)(1)(x) as paragraphs (e)(1)(ii) through (e)(1)(xi), respectively, and adding a new paragraph (e)(1)(i).

The added and revised text reads as follows:

52.212-5

Contract Terms and Conditions Required To Implement Statutes or Executive Orders—Commercial Items.

* * * * *

Contract Terms and Conditions Required To Implement Statutes or Executive Orders—Commercial Items

(Dec 2008)

* * * * *

(b) * * *

(2) 52.203-13, Contractor Code of Business Ethics and Conduct (DEC 2008)(Pub. L. 110-252, Title VI, Chapter 1 (41 U.S.C. 251 note)).

* * * * *

(e) * * *

(1) * * *

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (DEC 2008) (Pub. L. 110-252, Title VI, Chapter 1 (41 U.S.C. 251 note)).

* * * * *

52.213-4

[Amended]

13. Amend section 52.213-4 by—

a. Revising the date of the clause to read (DEC 2008); and

b. Removing from paragraph (a)(2)(vi) “(MAR 2007)” and adding “(DEC 2008)” in its place.

14. Amend section 52.244-6 by—

a. Revising the date of the clause;

b. Redesignating paragraphs (c)(1)(i) through (c)(1)(vi) as paragraphs (c)(1)(ii) through (c)(1)(vii), respectively, and adding a new paragraph (c)(1)(i).

The added and revised text reads as follows:

52.244-6

Subcontracts for Commercial Items.

* * * * *

Subcontracts for Commercial Items

(Dec 2008)

* * * * *

(c)(1) * * *

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (DEC 2008) (Pub. L. 110-252, Title VI, Chapter 1 (41 U.S.C. 251 note).

* * * * *