07-5800. Federal Acquisition Regulation; FAR Case 2006-007, Contractor Code of Business Ethics and Conduct

AGENCIES:

Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA).

ACTION:

Final rule.

SUMMARY:

The Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (Councils) have agreed on a final rule amending the Federal Acquisition Regulation (FAR) to address the requirements for a contractor code of business ethics and conduct and the display of Federal agency Office of the Inspector General (OIG) Fraud Hotline Posters.

DATES:

Effective Date: December 24, 2007

FOR FURTHER INFORMATION CONTACT:

Mr. Ernest Woodson, Procurement Analyst, at [phone] for clarification of content. For information pertaining to status or publication schedules, contact the FAR Secretariat at [phone]. Please cite FAC 2005-22, FAR case 2006-007.

SUPPLEMENTARY INFORMATION:

A. Background

DoD, GSA, and NASA published a proposed rule in the Federal Register at 72 FR 7588, February 16, 2007, to address the requirements for a contractor code of business ethics and conduct and the display of Federal agency Office of the Inspector General (OIG) Fraud Hotline Posters. The original comment period closed on April 17, 2007, but on April 23, 2007, the comment period was reopened and extended to May 23, 2007. We received comments from 42 respondents plus an additional late comment from one of the initial respondents. However, 15 of the respondents were only requesting extension of the comment period. The remaining 27 public comments are addressed in the following analysis.

The most significant changes, which will be addressed, are—

• The clause requirement for a formal training program and internal control system has been made inapplicable to small businesses (see paragraph 5.c.v. and 11. of this section);
• The contracting officer has been given authority to increase the 30 day time period for preparation of a code of business ethics and conduct and the 90 day time period for establishment of an ethics awareness and compliance program and internal control system, upon request of the contractor (see paragraph 6.c. of this section);
• The requirements in the internal control system relating to “disclosure” and “full cooperation” have been deleted, and moved to FAR Case 2007-006 for further consideration (see paragraphs 2.e. and 6.d. of this section);
• The clause 52.203-XX with 3 alternates has been separated into 2 clauses, one to address the contractor code of business ethics and conduct, and one to address the requirements for hotline posters (see paragraphs 3.h. and 10.b. of this section); and
• A contractor does not need to display Government fraud hotline posters if it has established a mechanism by which employees may report suspected instances of improper conduct, and instructions that encourage employees to make such reports (see paragraph 7.a. of this section).

1. General support for the rule.

Comments: The majority of respondents expressed general support for the rule. These included consultants, industry associations, a non-profit contractor, a construction contractor, inspectors general and interagency IG working groups, other Government agencies, and individuals. Many respondents were laudatory of the rule in general. For example, one respondent considered the proposed rule to be a “good attempt” and another considered it to be “an outstanding, well thought-out and needed policy change.” Others identified particular benefits of the proposed rule, such as—

• Reduce contract fraud;
• Reduce waste, fraud, abuse and mismanagement of taxpayers' resources;
• Enhance integrity in the procurement system by strengthening the requirements for corporate compliance systems; and
• Promote clarity and Government-wide consistency in agency requirements.

Response: None required.

2. General disagreement with the rule as a whole.

Although all respondents agree that contractors should conduct themselves with the highest degree of integrity and honesty, not all agree that the proposed rule is taking the right approach to achieve that goal.

a. Ineffective.

Comment: One respondent considers that this rule will not effectively correct the ethics and business conduct improprieties. Other respondents note that a written code of ethics does not ensure a commitment to compliance with its provisions.

Response: There is no law, regulation, or ethics code that ensures compliance. Laws, regulations, and ethics codes provide a standard against which to measure actions, and identify consequences upon violation of the law, regulation, or ethics code.

b. Unnecessary or duplicative, potentially conflicting.

Comment: One respondent views the rule as unnecessary, because it adds “a further level of compliance and enforcement obligations where contractors already are or may be contractually or statutorily obliged to comply.” Another respondent comments that the rule is duplicative of other similar requirements. Furthermore, meeting multiple requirements for the same purpose can cause conflicts.

Response: This rule is not duplicative of existing requirements known to the Councils. The rule requires basic codes of ethics and training for companies doing business with the Government. Although many companies have voluntarily adopted codes of business ethics, there is no current Government-wide regulatory requirement for such a code. For DoD contracts, the Defense Federal Acquisition Regulation Supplement (DFARS) recommends such a code, but does not make it mandatory.

Legislation such as the Sarbanes-Oxley Act of 2002 (Pub. L. 107-204), cited by some of the respondents, applies only to accounting firms and publicly traded companies. Sarbanes-Oxley focuses on auditor independence, corporate governance, internal control assessment, and enhanced financial disclosure. Sarbanes-Oxley provides broad definition of a “code of ethics” but does not specify every detail that should be addressed. It only requires publicly-traded companies to either adopt a code of ethics or disclose why they have not done so.

The respondents did not identify any specific points of conflict between this rule and other existing requirements. Since this requirement is broad and flexible, capturing the common essence of good ethics and standards of conduct, the Councils consider that it should reinforce or enhance any existing requirements rather than conflict with them.

c. Negative effect on current compliance efforts.

Comment: According to one respondent, the rule may have a “chilling effect” on current compliance efforts and may create a fragmented approach to standards of conduct.

Response: As stated in the prior response, this rule should enhance current compliance efforts.

d. Vague and too broad.

Comment: Several respondents consider the rule too vague and broad, so that it is open to different interpretations.

Response: The rule is intended to allow broad discretion. The specific requirements of the rule will be further addressed under paragraph 6. of this section.

e. Change in role of Government.

Comment: One respondent fears that the rule will “fundamentally change the Government's role in the design and implementation of contractor codes and programs” because it moves from “the well-established principles of self-governance and voluntary disclosure” to “contractual prescriptions and potentially mandatory disclosure.” This respondent states that the proposed rule is not just a minor modification of existing policy. Rather, it “would change far more than the FAR Councils have acknowledged.”

Response: This rule does constitute a change. The Councils are requiring that contractors establish minimum standards of conduct for themselves. However, the rule still allows for flexibility and, where appropriate, contractor discretion. The Councils have deleted any clause requirement relating to mandatory disclosure but it will be considered as part of the new FAR Case 2007-006 (72 FR 64019, November 14, 2007).

f. Unduly burdensome and expensive for contractors.

Comment: One respondent thinks that this rule imposes significant new requirements on contractors. Other respondents consider the requirement unduly burdensome for the contractors. They think the rule will be a disincentive to doing business with the Government.

Response: Most companies already have some type of ethics code. The mandatory aspects of this rule do not apply to commercial items, either at the prime or subcontract level. The rule has been changed to lessen the impact on small businesses (see paragraph 11. of this section).

g. Impact on small business.

Comment: Several respondents note the impact on small businesses.

Response: See detailed discussion of impact on small business at paragraph 11. of this section and changes to the rule to lessen that impact.

h. Difficult to administer for Government.

Comment: Several respondents consider the rule expensive and impractical to administer for the Government. One respondent comments on the further paperwork burdens on contracting officials, and that it cannot be effectively administered.

Response: There are no particularly burdensome requirements imposed on the Government by this rule. Review of contractors' compliance would be incorporated into normal contract administration. The Government will not be reviewing plans unless a problem arises.

i. Rule should be withdrawn or issue 2nd proposed rule.

Comment: One respondent requests that the rule be withdrawn. Several respondents recommend significant redrafting of the proposed rule and an opportunity to comment on a second proposed rule that makes important revisions.

Response: Although the Councils have made significant revisions to the proposed rule to address the concerns of the public, the revisions do not go beyond what could be anticipated from the text of the proposed rule and the preamble to the proposed rule. The changes are in response to the public comments. They do not rise to the level of needing republication under 41 U.S.C. 418b. However, the Councils published a new proposed rule on mandatory disclosure under FAR case 2007-006.

3. Broad recommendations.

a. Should not cover ethics.

Comment: One respondent recommends not using the term “ethics” throughout the rule. Contractors can and should develop and train employees on appropriate standards of business conduct and compliance for its officers, employees and others doing (or seeking to do) business with the Federal Government. However, contractors typically do not teach “ethics” to their employees.

Response: The term “ethics” is a term currently used throughout the FAR (reference FAR 3.104 and 9.104-1(d)) and is not considered to be an unfamiliar term to the professional business world. However, the Councils have modified the term to “business ethics,” consistent with usage in other FAR parts.

b. 2005 Federal Sentencing Guidelines.

Comments: Several respondents comment that the requirements of an internal control system should be like the United States Sentencing Commission 2005 Federal Sentencing Guidelines (Ch. 8 section 8B2.1), either by direct incorporation into the FAR or by reference. The proposed rule already included 8B2.1(b)(2) and (b)(3). One respondent is concerned that if they are not identical, businesses (especially small businesses) will believe they have met the compliance requirements of the U.S. Government by following the FAR; this will create a false sense of security. This respondent believes that the FAR requirements fall short when compared to the corporate sentencing guidelines. The respondent also points out that there are no clauses applying to smaller contracts, or to commercial item contracts, although companies with these contracts are still subject to the sentencing guidelines. Key requirements of the guidelines are omitted from the rule, such as knowledgeable leadership, exclusion of risky personnel, and individuals with day-to-day responsibility for implementing compliance systems.

Several respondents ask for a specific reference to be made in the rule to the U.S. Sentencing Guidelines.

• First, in this area of corporate compliance, it could be confusing if it appeared that the FAR was setting a different standard than the Sentencing Commission and the Federal courts, which implement the Guidelines.
• Second, the Sentencing Guidelines are subject to routine reexamination and revision by both the Sentencing Commission after substantial study and public comment, and the Federal courts in specific cases, allowing for adjustments to this proposed rule without having to open a new FAR case.

Therefore, the respondent believes that the Guidelines should serve as the baseline standard for a contractor's code of ethics and business conduct. By referencing the Guidelines, we would be able to ensure that the Federal Government speaks with one voice on corporate compliance.

Response: The initiators of the case asked that the FAR mirror the DFARS. The DFARS provisions are very similar to the Sentencing Guidelines and are adequate for this final rule. It would require public comment to include additional requirements from the Sentencing Guidelines as requirements in the FAR. The request to more closely mirror the Sentencing Guidelines is being considered as part of a separate case, FAR 2007-006.

c. Make pre-award requirement.

Comments: One respondent suggests making the rule a pre-award requirement, to ensure that only contracts are awarded to firms electing to conduct business in an ethical manner, consistent with FAR Part 9. The respondent believes that once contractors choose to implement the program with employees acknowledging the consequences of violations, it becomes a self-perpetuating program, requiring no additional actions by the contractor other than certification for new awards.

Response: FAR Part 9 (9.104-1(d)) already provides that a prospective contractor must have a satisfactory record in integrity and business ethics as a standard for determining a prospective contractor responsible as a pre-award requirement. The Councils believe that the respondent's suggestion would encumber or circumvent new contract awards which the Government wishes to encourage. Therefore, no change to the rule has been made.

d. Hire certified management consultants (CMCs).

Comments: One respondent recommends that the rule be amended to encourage Government agencies that are hiring consultants to hire Certified Management Consultants or those who ascribe or commit to a code of ethics from an acceptable professional organization such as the Institute of Management Consultants for all Government contracts, including consulting and/or advisory services.

Response: It is the contractors' responsibility to comply with the rule and establish a code of business ethics. The Government cannot endorse any particular business or organization as an appropriate contractor. Therefore, the Councils have not changed the rule in response to this comment.

e. Use quality assurance systems.

Comments: One respondent states that the rule does not lead to future improvements in compliance methods. The respondent recommends that, where possible, corporate compliance systems might be bolstered by drawing on and meshing compliance with existing quality assurance systems. Traditional quality assurance systems, used to capture errors, may be applied to corporate compliance systems to catch and root out ethical and legal failures.

Response: The cost of additional controls may or may not balance with the benefit received and should be carefully considered prior to implementation. While a contractor may elect to draw on existing systems as an additional internal control, the Councils have left the rule unchanged in this regard and do not specifically require use of existing quality assurance systems.

f. Establish rewards rather than punishments.

Comments: One respondent states that the regulation offers an opportunity to establish a regulation that rewards contractors who behave appropriately, contradicting the Federal Government's “. . . mindset to penalize the wrong doer rather than rewarding the desired behavior.”

Response: The Councils do not agree that this regulation should include a special “reward” for contractors who behave ethically. The Government “rewards” contractors who perform satisfactorily through payment of profit on the contract, favorable past performance evaluations, and the potential award of additional contracts.

g. Should not be mandatory - be more like the DFARS.

Comments: Several respondents expressed the view that the FAR rule should be modeled on the DFARS rule at Subpart 203.70, which is discretionary rather than mandatory. It states that contractors should have standards of conduct and internal control systems. One of these respondents believes that the proposal to impose contractual mandates is misguided.

Response: The discretionary rule in the DFARS is no longer strong enough in view of the trend (U.S. Sentencing Guidelines and the Sarbanes-Oxley Act) to increase contractor compliance with ethical rules of conduct. According to the Army Suspension and Debarment Official, the majority of small businesses that he encounters in review of Army contractor misconduct, have not implemented contractor compliance programs, despite the discretionary DFARS rule.

However, with regard to the requirement for posters when the contractor has established an adequate internal reporting mechanism, see paragraph 7. of this section.

h. More logical sequence for procedures and clause, and delete opening paragraph of procedures.

Comment: One respondent recommends that the proposed changes at 3.1003 be rewritten in a logical sequence. This respondent also recommended that the clause paragraphs should be rewritten in logical sequence with the alternate versions sequentially deleting the last paragraphs instead of creating the delete and renumber provisions.

Another respondent recommends deletion of the opening paragraph at 3.1003 because following the procedures does not ensure that the policies are implemented.

Response: The procedures section has been completely rewritten to reduce redundancy and inconsistencies. The Councils have separated the clause into two clauses, which makes the second point about logical order in the clause moot. The opening paragraph at 3.1003 has been deleted.

4. Policy.

a. “Should” vs. “shall.”

Comment: At least four respondents comment on an inconsistency between “should” in the policy and “shall” elsewhere. Section 3.1002, Policy, states that contractors “should” have a written code of ethics, etc, while the Section 3.1003, Procedures, and the contract clause at 52.203-13 makes the programs mandatory unless the contract meets one of several exceptions.

Response: The inconsistency was deliberate. The policy applies to all contractors but the specific mandatory requirements of the clause apply only if the contract exceeds $5 million and meets certain other criteria. Section 3.1003 has been rewritten as “Mandatory requirements” to clearly distinguish it from the policy, which applies to all Government contractors.

b. “Suitable to” vs. “commensurate with.”

Comment: One respondent comments that the policy uses the phrase “suitable to” the size of the business whereas the clause uses the term “Commensurate with.”

Response: The phrase “commensurate with” has been deleted from the clause.

5. Exceptions—general.

Comments: Two respondents commented on the exceptions to the rule in general.

• The rule be revised to list exceptions separately.
• The key exceptions to the rule in subpart 3.1003(a) and 3.1004(a)(1) are not consistent. 3.1003(a) exempts contracts awarded under FAR Part 12 from the required employee ethics and compliance-training program and internal control system, or displaying the fraud poster, but it does not list the exemption from having a written code of business ethics. 3.1004(a)(1) clearly exempts contracts awarded under FAR Part 12 from all of the clause requirements.

Response: The Councils partially concur with the respondents' recommendations. The Councils have revised the final rule to—

• Move the exceptions into the clause prescription; and
• Delete the conflicting wording in the proposed rule at 3.1003(a).

a. Commercial items.

i. Concur with exception for commercial items.

Comment: Two respondents agree that the rule should exclude contracts awarded under FAR Part 12. One respondent agrees with the intent of the rule concerning consistent standards of ethics and business conduct for Federal contracts, and the exclusion FAR 12. Another respondent agrees that all contractors should have written codes of conduct as a good business practice code of, but believes the FAR Part 12 exemption should be from the full coverage of the rule, including the written code of conduct requirement.

Response: The Councils note that the FAR Part 12 exemption does include exemption from the requirement for a written code of conduct (see introductory paragraph at beginning of this Section 5.)

ii. Disagree with exception for commercial items.

Comments: Three respondents comment that the rule should apply to commercial contracts. They note that although other Federal agencies currently maintain polices similar to the rule, none of the agencies exclude contracts for commercial services. One respondent recommends that the rule apply to commercial item contracts or require that such contractors should have compliance systems in place, especially since such firms fall under the Sentencing Commission's general expectation that corporations will put appropriate compliance systems in place. Another respondent is concerned that the “errant behavior of contractors” will not stop at contracts awarded under FAR Part 12 and by carving out a major segment of acquisitions to which the rule will not apply, the rule sub-optimizes its intended effect of reducing unethical behavior.

Response: The Councils do not agree the clause should be included in contracts awarded under Part 12. Requiring commercial item contractors to comply with the mandatory aspects of the rule would not be consistent with Public Law 103-355 that requires the acquisition of commercial items to resemble customarily commercial marketplace practices to the maximum extent practicable. Commercial practice encourages, but does not require, contractor codes of business ethics and conduct. In particular, the intent of FAR Part 12 is to minimize the number of Government-unique provisions and clauses. The policy at 3.1002 of the rule does apply to commercial contracts. All Government contractors must conduct themselves with the highest degree of integrity and honesty. However, consistent with the intent of Pub. L. 103-355 and FAR Part 12, the clause mandating specific requirements is not required to be included in commercial contracts.

iii. Disagree with exception for commercial items if contract is for advisory and assistance services.

Comment: One respondent believes that the rule should apply to all advisory and assistance services, some of which are commercial items.

Response: The Councils have not agreed to make further distinctions between the types of contracts to which the rule should apply. For the same reasons stated in answer to the prior comment, the Councils do not agree to application of this rule to advisory and assistance services that are commercial items.

b. Outside U.S.

Comment: Two respondents comment on the exception for contracts to be performed outside the United States, mostly from a definitional perspective.

i. Supporting office in the U.S.

Comment: One respondent suggests that the meaning of “work currently performed outside the United States” needs to be better defined. The proposed rule is unclear whether offices in the United States supporting the foreign project would be required to comply.

Response: The term “performed outside the United States” is used throughout the FAR several dozen times. There is never any explanation regarding possible application to offices in the United States supporting the foreign project. If part of a contract is performed in the United States and part of it is performed outside the United States, then the part performed in the United States is subject to whatever conditions apply to work performed in the United States.

ii. Outlying areas.

Comments: One respondent specifically endorses the exception for contracts performed outside the United States. However, the respondent requests clarification of the term “outlying areas.”

Response: This term is defined in FAR 2.101.

c. Dollar threshold.

Eight respondents commented on the rule's $5 million threshold.

i. Should not allow agencies to require posters below $5 million.

Comments: One respondent does not support the requirement at the 3.1003(c) that authorizes agencies to establish policies and procedures for the display of the agency fraud hotline poster for contracts below $5 million.

Response: Federal agency budgets and missions vary and are distinct. Some agencies already require display of the hotline posters below the $5 million threshold. For this reason, agencies that desire to have contractors display the hotline poster should be allowed to implement the program in a way that meets their needs. Therefore, the Councils have not made any change to the rule in response to this comment.

ii. There should be no threshold.

Comment: Three respondents suggest removing the $5 million threshold and requiring all contractors to comply with the rule.

In addition, the late supplemental comment received from the U.S. Government Office of Ethics expressed concern that a specific instance of conflict of interest problems occurred with two contracts that would not meet the $5 million threshold.

Response: The Councils do not agree with removal of the threshold. Removing the $5 million dollar threshold and requiring all contractors to comply with the rule is not practical. At lower dollar thresholds, the costs may outweigh the benefits of enforcing a mandatory program. Nevertheless, the policy at 3.1002 applies to all contractors.

The Councils note with regard to the OIG audit report ED-OIG/A03F0022 of March 2007, that the contractor in question did not include the required conflict of interest clauses in its subcontracts and consulting agreements. This is the essence of the problem rather than the lack of a contractor code of ethics and compliance and internal control systems in contracts less than $5 million.

iii. How is application of the threshold determined?

Comment: One respondent is concerned that the rule fails to state how the $5 million threshold for the application of the clause is to be determined and questions if the threshold should apply to contracts with multi-years as the option years for such contracts may not be awarded, thereby impacting the total value of the contract award. The respondent recommends that the threshold apply to contracts with one term and only to the base year in contracts with options.

Response: FAR 1.108(c) provides uniform guidance for application of thresholds throughout the FAR.

iv. $5 million threshold is too low.

Comments: One respondent is concerned that many companies have not implemented programs that would adequately meet the rule and that the $5 million threshold is too low. It will therefore serve as a disincentive for many small and medium—sized companies who may not be willing or able to comply with the requirement to implement training and control systems.

Response: The $5 million threshold is consistent with the threshold established by the U.S. Department of Defense (DoD) for contractor ethics. DoD contracts with the largest number of Federal contractors. Therefore, the Councils have not made any change to the threshold for application of the clause. For revisions made to lessen the impact on small business see paragraph 11. of this section.

v. Alternate standards.

Comment: One respondent recommends that the rule focus on the size of the firm and its volume of Federal work over a more significant period of time, and that SBA size standards and some proportion of the work the contractor performs be used as determining factors.

Response: The Councils have revised the final rule to limit the requirement for formal awareness programs and internal control systems to large businesses, while retaining the $5 million threshold for application of the clause. The clause needs to be included, because it might flow down from a small business to a large business, from whom full compliance would be required. Although the proposed rule allowed contractors to determine the simplicity or complexity and cost of their programs “suitable to the size of the company and extent of its involvement in Government contracting,” this left many respondents unsure as to what would be acceptable (see also paragraph 11. of this section).

Comment: One respondent is concerned that the rule does not adequately identify which contractors should be covered by the requirements and suggests that the kind of work and responsibilities of the contractor is a better indicator of the need for ethics rules than the size of the contract award.

Response: As a practical matter, all contractors doing business with the Government should have a satisfactory of integrity and business ethics, irrespective of the work the contractor is performing or the dollar amount of the contract. However, given the volume and complexities of work contractors perform for the Government, it is not practical to apply the rule on the basis of a contractor's work or responsibilities. It is more realistic for the Government to establish monetary thresholds and/or size standards to ensure its widest impact and viability.

d. Performance period.

Comments: Five respondents commented on the 120-day performance period, considering that 120 days is too short, because it takes longer than that to implement a compliance program, including an internal control system. Even if the compliance programs can be implemented in the required timeframe, that leaves as little as 30 days between implementation of the program and completion of the contract. The 120-day performance period operates as a disincentive to small and medium size companies. Some respondents recommend using a minimum of one year for the period of performance.

Response: The Councils do not concur that 120 days is too short. Although on an initial contract it may take some time to get the program established, on follow-on contracts the program will already be in operation. Many contracts responding to emergency situations are of short duration, and are the very type of contract that needs to be covered. The contracting officer is given leeway in the final rule to expand the 90-day period (See paragraph 6.c. of this section).

e. Other exceptions.

Comment: Two respondents submitted comments suggesting an expansion to the list of exceptions.

One respondent recommends two additional exceptions to the language at 3.1003, to make it clear that the new subpart is only applicable for new, open market, contract awards or agreements. Additional exceptions would include “delivery or task orders placed against GSA Federal Supply Contracts, using Part 8 procedures,” and “orders placed against task order and delivery order contracts entered into pursuant to Subpart 16.5, Indefinite Delivery Contracts.”

Another respondent recommends that research and development contracts issued to universities and other nonprofit organizations be exempt from the rule. Research institutions uniformly have business codes of conduct and internal controls to enable the reporting of improper conduct as well as disciplinary mechanisms (reference OMB Circular A-110). In addition, the National Science and Technology Council's Committee on Science is currently developing voluntary compliance guidelines for recipients of Federal research funding from all agencies across the Federal Government, to help recipients address the prudent management and stewardship of research funds and promote common policies and procedures among the agencies.

Response: The rule is not applicable to existing contracts. Therefore, an exception for delivery or task orders placed against GSA Federal Supply Contracts or issued under existing Indefinite Delivery Contracts is not necessary.

While universities and other nonprofit organizations may have existing guidelines, policies and procedures for business codes of conduct, there are many benefits of including a clause in new solicitations and contracts. The rule will strengthen the requirements for corporate compliance systems and will promote a policy that is consistent throughout the Government. Therefore, the Councils have not made any changes to the rule in this regard, although the burden on small businesses has been reduced (see 52.203-13(c)).

6. Contractor program requirement.

a. Lack of specific guidelines.

Comments: Various respondents express the view that the rule should be more specific about the required programs.

• Some provided examples of what should be included.
• One was concerned that contractors have increased risk of False Claims Act because when seeking payments under fixed-price construction contracts, they would have to certify that they sought compensation “only for performance in accordance with the specifications, terms, and conditions of the contract”, including the new and highly subjective requirements in the proposed rule.
• One recommended that the FAR rule should be held until GAO finishes its study of contractor ethics at DoD.
• Another recommended that the Councils should establish a Government-industry panel to develop a minimum suggested code of ethics and business conduct based upon the best practices many contractors already employ.

Response: This rule gives businesses flexibility to design programs. Many sample codes of business ethics are available on-line. The specific issues that should be addressed may vary depending on the type of business. To provide more specific requirements would require public comment. The new FAR Case 2007-006 will propose the imposition of a set of mandatory standards for an internal control system. The Councils will welcome suggestions for further FAR revisions when the GAO finishes its study.

b. Compliance.

Comment: Several respondents questions how the contracting officer would verify compliance with the requirements. There is no requirement for submission to the Government. The internal control system states what should be included. Are these mandatory requirements or is it the judgment of the contracting officer?

Response: The contracting officer is not required to verify compliance, but may inquire at his or her discretion as part of contract administrative duties. Review of contractors' compliance would be incorporated into normal contract administration. The Government will not be routinely reviewing plans unless a problem arises. The Government does not need the code of ethics as a deliverable. What is important is that the Contractor develops the code and promotes compliance of its employees.

“Should” provides guidance and examples, rather than a mandatory requirement. The contracting officer does not judge the internal control system, but only verifies its existence.

c. Time limits.

Various suggestions were made about the time allotted to develop a code of ethics.

• One respondent recommends 180 days for the code.
• Another recommended an extension to 60 days after contract award.
• One respondent states that it takes significantly longer than 30 days to put a written code of conduct in place. In order to be successful, the process should include an analysis of what should be in the code, drafting the code, stakeholder input, publication, and communication of the resulting code. This is difficult to accomplish in less than 6 months and usually requires at least a year to do well.

The same respondents also commented about whether 90 days is sufficient to develop a training program and internal control systems. For example, one respondent comments that compliance training programs must be well designed and relevant to be effective. Establishing an internal-control system also takes significantly more than 90 days. According to the respondent, the rule would yield “cookie-cutter” compliance, devoid of any real commitment to ethics and compliance.

Response: Although the Councils consider that the specified time periods are generally adequate, the Councils have revised the clause so that companies needing more time can request an extension from the contracting officer. The Councils also note that an initial code and program can be subject to further development over time, as experience with it suggests areas for improvement.

d. Internal Control Systems—mandatory disclosure and full cooperation.

Comments: Six respondents consider the requirements for the internal control system regarding disclosure to the Government and full cooperation with the Government to be problematic. Reporting suspected violations of law is troubling and requested more information on the trigger to the requirement. One respondent expresses concern with possible violations of constitutional rights associated with the disclosures.

Other respondents are concerned that “full cooperation” can force companies to relinquish or waive the attorney-client privilege. One respondent requests that the preamble state that full cooperation does not waive attorney-client privilege or attorney work product immunity.

Another respondent recommends expansion of the full cooperation requirement to cover audits. Information received by the OIG may precipitate an audit, rather than a criminal investigation.

Response: The Councils note that the most controversial paragraphs (paragraphs (c)(2)(v) and (vi) in the proposed rule) were not mandatory, but were listed as examples of what a contractor internal control system should include. The mandatory disclosure requirement in paragraph (c)(1)(i) of the proposed rule was not clear about disclosure to whom. The Councils have removed the disclosure requirement at paragraph (c)(1)(i) of the proposed clause and the examples at (c)(2)(v) and (vi) from this final rule. These issues were included for further consideration in the proposed rule issued for public comment under FAR Case 2007-006.

7. Display of posters.

a. Agency posters.

i. Government posters are unnecessary, if the contractor has internal reporting mechanisms.

Comments: Several respondents do not agree that Government hotline posters should need to be displayed if the contractor has its own code of ethics and business conduct policy and processes already in place to conform to the DFARS rule.

One respondent cites DFARS 203.7001(b), which recognizes and permits companies to post their own internal hotline poster, in lieu of an agency Inspector General (IG) hotline poster, for employees to have an outlet to raise any issues of concern. The respondent believes this coverage is adequate and there is no need to impose an additional requirement to display agency IG hotline posters.

Another respondent states that the rule that requires all Federal contractors to post agency hotlines would deny such contractors the opportunity to funnel problems through their internal control systems and frustrate at least much of the purpose of establishing such systems. One respondent states that companies want an opportunity to learn about internal matters first and to be in the best position to take corrective action.

Another states that while the agencies currently all mandate that their contractors display a fraud hotline, none mandate that their contractors display a Government hotline. DoD, Veterans Administration, and Environmental Protection Agency currently require their contractors to post their agency hotlines unless they have “established a mechanism, such as a hotline, by which employees may report suspected instances of improper conduct, and instruction that encourage employees to make such reports.” Several other respondents recommend that the FAR Councils take the same approach.

Response: Although the proposed rule did not prevent contractors from posting their own hotline posters, the Councils have determined that it will fulfill the objective of the case to mirror DFARS 252.203-7002, Display of DoD Hotline Poster, i.e., display of the Government posters is not required if the contractor has established an internal reporting mechanism by which employees may report suspected instances of improper conduct along with instructions that encourage employees to make such reports.

ii. Too many posters are unnecessary and potentially confusing.

Comments: Several respondents believe that requiring all contractors to display the hotlines for all Federal agencies for which they are working—without regard to the number of such agencies, or the contractors' own efforts to encourage their employees to report any evidence of improper conduct—would have several negative and unintended consequences. Rather than facilitate reporting, multiple postings could confuse employees. To which agency should they report a particular problem? Adding agency-specific requirements to existing compliance programs dilutes the impact and message of the existing program and will likely lead to confusion among professionals. A bulletin board with myriad compliance references will be confusing at best.

Response: Each agency's IG may require specific requirements and information for posters. There is no central telephone number or website that serves as the hotline for all agency IGs. However, under the final rule, if the company has its own internal reporting mechanism by which employees may report suspected instances of improper conduct along with instructions that encourage employees to make such reports, there is no need to hang multiple agency posters.

iii. Responsibility for determining the need for displaying an agency IG Fraud Hotline Poster?

Comment: Several respondents note that the Inspector General Act of 1978 gives the agency's IG (not the agency) the responsibility for determining the need for, and the contents of, the fraud hotline poster.

Response: The Councils agree that it is not the agency that decides the need for the poster, but the agency IG. The Councils have made the requested change at FAR 3.1003(b).

b. Department of Homeland Security (DHS) Posters.

i. Only when requested by DHS?

Comment: One respondent states that in the Federal Register background and in the proposed language at 3.1003(d)(2) the guidance seems to imply that the display of the DHS poster is required for contracts funded with disaster assistance funds, when and only when so requested by DHS.

Response: This interpretation is correct. The final rule clarifies that it is the DHS Inspector General that requests use of the posters.

ii. Different poster for each event is not best approach.

Comment: One respondent believes that the contractor's own hotline, if one exists, is better suited to providing a mechanism for employees to report concerns than a different poster for each event.

Response: DHS Inspector General must determine whether to use event-specific or broad posters to cover multiple events. However, the Councils have revised the final rule to permit use of the Contractor's own hotline poster if the contractor has an adequate internal control system.

8. Remedies.

Comments: Four comments concerning proposed remedies were received. In general, two of the respondents questioned consistency in application, consistency, and due process, and two were generally opposed to the remedies.

• One respondent asks whether there “should be remedies for non-compliance when the contractor is not required to affirm or otherwise prove compliance, and when there is no adequate guidance for the CO regarding a determination of compliance?” Without guidance, contracting officers in different agencies may make different assessments of the same contractor.
• One respondent “cannot find any rational relationship between the proposed “remedies” and any damages or other losses that the Government might suffer from any breach of the new contractual requirements ethics codes and compliance programs.” This respondent strongly recommends that the contractual remedies be limited to such equitable measures as may be necessary to bring the contractor into compliance with its contract obligations to implement certain procedures, and omit any monetary penalties.
• One respondent expressed a similar concern that the remedies “are improper, excessive and unwarranted.”
• One respondent requests provision of due process with a proposal to include the following text; “Prior to taking action as described in this clause, the Contracting Officer will notify the Contractor and offer an opportunity to respond.”

Response: The Councils have decided that remedies should not be specified in the clause. The FAR already provides sufficient remedies for breach of contract requirements.

9. Flowdown.

a. Objections to rule also apply to flowdown.

Naturally, those respondents that oppose the rule in general or in particular, will also oppose its flowdown in general or in particular. For example,

• Comment: One respondent recommends exempting this requirement for subcontracts less than one year in length, rather than 120 days.

Response: See discussion in paragraph 5.d. of this section.

• Comment: Another respondent states that this requirement will negatively impact universities, especially given the flow-down requirements for prime contracts. This respondent recommends that research and development contracts issued to universities and other nonprofit organizations should be exempt from this proposed rule.

Response: See discussion at paragraph 5.e. of this section.

• Comment: Another respondent states that the rule has not estimated the number of small business subcontractors that will be adversely impacted by this requirement.

Response: See discussion at paragraph 11. of this section.

b. Rationale for the flowdown.

Comment: One respondent states that there is no rationale provided for this troubling and perplexing flowdown requirement and would like it to be deleted from the rule. None of the agencies currently require any flowdown to subcontractors.

Response: The same rationale that supports application of the rule to prime contractors, supports application to subcontractors. Meeting minimum ethical standards is a requirement of doing business with the Government, whether dealing directly or indirectly with the Government. The rule does not apply to contracts/subcontracts less than $5 million, exempts all commercial contracts/subcontracts, and the final rule reduces the burden on small business, whether prime or subcontractor.

c. Implementation.

Comment: One respondent has questions about the implementation of the flowdown. What is a subcontract—does it include purchase orders? The Government and the construction industry have a different concept of “subcontract.” They are concerned that the meaning of “subcontract” is therefore far from clear to general construction contractors and their subcontractors. Are prime contractors expected to distinguish subcontracts for commercial items from subcontracts for other goods and services?

Response: This issue is not specific to this case. Sometimes construction firms think that “subcontract” does not include purchase orders. The FAR does not make this distinction. The intent is that the flowdown applies to all subcontracts, including purchase orders. Prime contractors are expected to distinguish subcontracts for commercial items from subcontractors for other goods and services, not only for this rule but for many other FAR requirements (see FAR clause 52.244-6, Subcontracts for Commercial Items, which is included in all solicitation and contracts other than those for commercial items).

d. Enforcement.

Comment: Several respondents are concerned with how the flowdown requirement will be enforced. One respondent is concerned that prime contractors should not be responsible for subcontractors' compliance with this requirement. Monitoring of subcontracts would impose a significant new cost on prime contractors. Another respondent requests that the rule be revised to clarify that primes are not responsible for monitoring subcontractor compliance. This respondent is particularly concerned about the impracticality of a small or medium-sized business supervising the compliance of major subcontractors.

Response: The contractor is not required to judge or monitor the ethics awareness program and internal control systems of the subcontractors—just check for existence. The difficulty of a small business concern monitoring a large business subcontractor is true with regard to many contract requirements, not just this one. The Councils plan to further address the issue of disclosure by the subcontractor under the new FAR Case 2007-006.

10. Clause prescriptions.

a. Extraneous phrase.

Comment: Several respondents note that something is wrong with the following phrase in 3.1004(a)(1)(i): “ ...or to address Contractor Code of Ethics and Business Conduct and the display of Federal agency Office of the Inspector General (OIG) Fraud Hotline Poster”.

Response: The extraneous phrase has been removed from the final rule.

b. Alternates.

Comment: One respondent says that what “triggers the insertion of Alternate I or II clause language is ambiguous in the text of the Policy and Procedures sections of the rule and the confusion is compounded when read with the language used in the clause.”

One respondent comments that if the contract period of performance is less than 120 days and the agency has not established a requirement for posting at a lower dollar level, there is no requirement to include the clause; in this case Alternate II is never invoked. Another respondent recommends at 3.1004(c)(2) changing “at a lesser amount” to “for contracts valued at $5 million or less”.

Response: The Councils have decided to use two separate clauses, rather than one clause with alternates. The conditions for use of the alternates were so diverse, that it was impossible to comply with the FAR drafting conventions that the prescription for the clause should include both the requirements for the basic clause and any alternates. Although the Councils do not agree with the respondent (because the conditions are connected by “or” rather than “and”), any ambiguity in the prescription for Alternate II has been eliminated by the use of two clauses. The language at 3.1004(c)(2)(now 3.1004(b)(3)(ii)) has been clarified.

11. Regulatory Flexibility Analysis.

a. Impact on small business requires regulatory flexibility analysis.

Comment: Several respondents note that the rule will have a substantial impact on small business. The SBA Chief Counsel for Advocacy commented that the Councils should therefore publish an Initial Regulatory Flexibility Analysis. The SBA Chief Counsel for Advocacy points out that the minimal set-up cost for the ethics program and internal control system would be $10,000, according to one established professional organization; there would be further costs for maintaining the system, periodic training, and other compliance costs.

Another respondent asks how the finding that “ethics programs and hotline posters are not standard commercial practice” squares with the claim that the proposed rule “will not have a significant impact on a substantial number of small entities”. The respondent notes the absence of any cost estimate, or impact on competition for contracts and subcontracts. Mid-sized and small construction contractors would find the cost and complexity of restructuring their internal systems, and continuously providing the necessary training to employees scattered across multiple sites, to be very substantial, and might well exceed benefits of pursuing Federal work. (Another respondent echoes this.) The respondent recommends the Councils undertake a fresh data-driven analysis of how severely such mandates are likely to impact small businesses, including the level of small business participation in Federal work.

Another respondent comments that the rule may have an unduly burdensome impact on Government contractors, particularly smaller contractors. It may deter small and minority owned businesses from entering the Federal marketplace and from competing for certain contracts.

b. Alternatives. Several alternatives were presented for small business compliance with the regulation.

• Since small business size standards for the construction industry are well over $5 million in annual revenue, the exclusion of contracts under $5 million is not likely to insulate small business from the cost of compliance. Federal construction contracts typically exceed $5 million, and small construction contractors regularly perform them. Instead of $5 million, the requirements should be linked to the size standards the SBA established, and some proportion of the work that the contractor performs for the Federal Government. The construction industry size standard for general contractors is $31 million in average annual revenue. The requirements should be imposed on only the firms that both exceed the standard and derive a large proportion of their revenue from Federal contracts.
• Delay the flow down requirement to small business subcontractors, pending review of data on impact on small business subcontractors (SBA Chief Counsel for Advocacy).
• Provide additional guidance for small businesses on a code of ethics commensurate with their size.

Response:

Exclusion of commercial items. The original Regulatory Flexibility Act statement as published did not identify the rule's exclusion for commercial items. The burdens of the clauses will not be imposed on Part 12 acquisitions of commercial items. This is of great benefit to small businesses.

Reduced burden for small businesses. The Councils acknowledge the difficulty and great expense for a small business to have a formal training program, and formal internal controls. The Councils also acknowledge that the public was confused about the proposed rule's flexible language for small business: “Such program shall be suitable to the size of the company.”

The Councils have maintained the clause requirement for small businesses to have a business code of ethics and provide copies of this code to each employee. There are many available sources to obtain sample codes of ethics.

However, the Councils have made the clause requirements for a formal training program and internal control system inapplicable to small businesses (see also paragraph 5.c.v. of this section).

Because the clause 52.203-13 is still included in the contract with small businesses, the requirements for formal training program and internal control systems will flow down to large business subcontractors, but not apply to small businesses.

The Councils note that if a small business subsequently finds itself in trouble ethically, the need for a training program and internal controls will likely be addressed by the Federal Government at that time, during a criminal or civil lawsuit or debarment or suspension.

This is not a significant regulatory action and, therefore, was not subject to review under Section 6(b) of Executive Order 12866, Regulatory Planning and Review, dated September 30, 1993. This rule is not a major rule under 5 U.S.C. 804.

B. Regulatory Flexibility Act

The Department of Defense, the General Services Administration, and the National Aeronautics and Space Administration certify that this final rule will not have a significant economic impact on a substantial number of small entities within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq., because the rule does not require use of the clause requiring contractors to have a written code of business ethics and conduct if the contract is—

• Valued at $5 million or less;
• Has a performance period less than 120 days;
• Was awarded under Part 12; or
• Will be performed outside the United States.

Furthermore, after discussions with the Small Business Administration (SBA) Office of Advocacy, the Councils have made inapplicable to small businesses the clause requirement for a formal compliance awareness program and internal control system.

C. Paperwork Reduction Act

The Paperwork Reduction Act does not apply because the changes to the FAR do not impose information collection requirements that require the approval of the Office of Management and Budget under 44 U.S.C. 3501, et seq.

List of Subjects in 48 CFR Parts 2, 3, and 52

• Government procurement

Dated: November 16, 2007.

Al Matera,

Director, Office of Acquisition Policy.

Therefore, DoD, GSA, and NASA amend 48 CFR parts 2, 3, and 52 as set forth below:

1. The authority citation for 48 CFR parts 2, 3, and 52 continues to read as follows:

Authority: 40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 42 U.S.C. 2473(c).

PART 2—DEFINITIONS OF WORDS AND TERMS

2. Amend section 2.101 in paragraph (b), in the definition “United States” by redesignating paragraphs (1) through (7) as paragraphs (2) through (8), respectively, and adding a new paragraph (1) to read as follows:

2.101

Definitions.

(b) * * *

United States * * *

(1) For use in Subpart 3.10, see the definition at 3.1001.

PART 3—IMPROPER BUSINESS PRACTICES AND PERSONAL CONFLICTS OF INTEREST

3. Add Subpart 3.10 to read as follows:

Subpart 3.10—Contractor Code of Business Ethics and Conduct

3.1000

Scope of subpart.

3.1001

Definitions.

3.1002

Policy.

3.1003

Mandatory requirements.

3.1004

Contract clauses.

Subpart 3.10—Contractor Code of Business Ethics and Conduct

3.1000

Scope of subpart.

This subpart prescribes policies and procedures for the establishment of contractor codes of business ethics and conduct, and display of agency Office of Inspector General (OIG) fraud hotline posters.

3.1001

Definitions.

United States, as used in this subpart, means the 50 States, the District of Columbia, and outlying areas.

3.1002

Policy.

(a) Government contractors must conduct themselves with the highest degree of integrity and honesty.

(b) Contractors should have a written code of business ethics and conduct. To promote compliance with such code of business ethics and conduct, contractors should have an employee business ethics and compliance training program and an internal control system that—

(1) Are suitable to the size of the company and extent of its involvement in Government contracting;

(2) Facilitate timely discovery and disclosure of improper conduct in connection with Government contracts; and

(3) Ensure corrective measures are promptly instituted and carried out.

3.1003

Mandatory requirements.

(a) Requirements. Although the policy in section 3.1002 applies as guidance to all Government contractors, the contractual requirements set forth in the clauses at 52.203-13, Code of Business Ethics and Conduct, and 52.203-14, Display of Hotline Poster(s), are mandatory if the contracts meet the conditions specified in the clause prescriptions at 3.1004.

(b) Fraud Hotline Poster. (1) Agency OIGs are responsible for determining the need for, and content of, their respective agency OIG fraud hotline poster(s).

(2) When requested by the Department of Homeland Security, agencies shall ensure that contracts funded with disaster assistance funds require display of any fraud hotline poster applicable to the specific contract. As established by the agency OIG, such posters may be displayed in lieu of, or in addition to, the agency's standard poster.

3.1004

Contract clauses.

Unless the contract is for the acquisition of a commercial item under part 12 or will be performed entirely outside the United States—

(a) Insert the clause at FAR 52.203-13, Contractor Code of Business Ethics and Conduct, in solicitations and contracts if the value of the contract is expected to exceed $5,000,000 and the performance period is 120 days or more.

(b)(1) Insert the clause at FAR 52.203-14, Display of Hotline Poster(s), if—

(i) The contract exceeds $5,000,000 or a lesser amount established by the agency; and

(ii)(A) The agency has a fraud hotline poster; or

(B) The contract is funded with disaster assistance funds.

(2) In paragraph (b)(3) of the clause, the contracting officer shall—

(i) Identify the applicable posters; and

(ii) Insert the website link(s) or other contact information for obtaining the agency and/or Department of Homeland Security poster.

(3) In paragraph (d) of the clause, if the agency has established policies and procedures for display of the OIG fraud hotline poster at a lesser amount, the contracting officer shall replace “$5,000,000” with the lesser amount that the agency has established.

PART 52—SOLICITATION PROVISIONS AND CONTRACT CLAUSES

4. Add sections 52.203-13 and 52.203-14 to read as follows:

52.203-13

Contractor Code of Business Ethics and Conduct.

As prescribed in 3.1004(a), insert the following clause:

CONTRACTOR CODE OF BUSINESS ETHICS AND CONDUCT (DEC 2007)

(a) Definition.

United States, as used in this clause, means the 50 States, the District of Columbia, and outlying areas.

(b) Code of business ethics and conduct. (1) Within 30 days after contract award, unless the Contracting Officer establishes a longer time period, the Contractor shall—

(i) Have a written code of business ethics and conduct; and

(ii) Provide a copy of the code to each employee engaged in performance of the contract.

(2) The Contractor shall promote compliance with its code of business ethics and conduct.

(c) Awareness program and internal control system for other than small businesses. This paragraph (c) does not apply if the Contractor has represented itself as a small business concern pursuant to the award of this contract. The Contractor shall establish within 90 days after contract award, unless the Contracting Officer establishes a longer time period—

(1) An ongoing business ethics and business conduct awareness program; and

(2) An internal control system.

(i) The Contractor's internal control system shall—

(A) Facilitate timely discovery of improper conduct in connection with Government contracts; and

(B) Ensure corrective measures are promptly instituted and carried out.

(ii) For example, the Contractor's internal control system should provide for—

(A) Periodic reviews of company business practices, procedures, policies, and internal controls for compliance with the Contractor's code of business ethics and conduct and the special requirements of Government contracting;

(B) An internal reporting mechanism, such as a hotline, by which employees may report suspected instances of improper conduct, and instructions that encourage employees to make such reports;

(C) Internal and/or external audits, as appropriate; and

(D) Disciplinary action for improper conduct.

(d) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (d), in subcontracts that have a value in excess of $5,000,000 and a performance period of more than 120 days, except when the subcontract—

(1) Is for the acquisition of a commercial item; or

(2) Is performed entirely outside the United States.

(End of clause)

52.203-14

Display of Hotline Poster(s).

As prescribed in 3.1004(b), insert the following clause:

DISPLAY OF HOTLINE POSTER(S) (DEC 2007)

(a) Definition.

United States, as used in this clause, means the 50 States, the District of Columbia, and outlying areas.

(b) Display of fraud hotline poster(s). Except as provided in paragraph (c)—

(1) During contract performance in the United States, the Contractor shall prominently display in common work areas within business segments performing work under this contract and at contract work sites—

(i) Any agency fraud hotline poster or Department of Homeland Security (DHS) fraud hotline poster identified in paragraph (b)(3) of this clause; and

(ii) Any DHS fraud hotline poster subsequently identified by the Contracting Officer.

(2) Additionally, if the Contractor maintains a company website as a method of providing information to employees, the Contractor shall display an electronic version of the poster(s) at the website.

(3) Any required posters may be obtained as follows:

Poster(s)       Obtain from

_________  _________

_________  _________

(Contracting Officer shall insert— (i) Appropriate agency name(s) and/or title of applicable Department of Homeland Security fraud hotline poster); and

(ii) The website(s) or other contact information for obtaining the poster(s).)

(c) If the Contractor has implemented a business ethics and conduct awareness program, including a reporting mechanism, such as a hotline poster, then the Contractor need not display any agency fraud hotline posters as required in paragraph (b) of this clause, other than any required DHS posters.

(d) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (d), in all subcontracts that exceed $5,000,000, except when the subcontract—

(1) Is for the acquisition of a commercial item; or

(2) Is performed entirely outside the United States.

(End of clause)