Home > Legal Updates >

New Ethics Rules for Government Contractors

Newly Published Rules Require Written Codes of Business Ethics

Firms that that do business with the federal government are subject to a variety of rules and regulations. Most notable among them, perhaps, is the Federal Acquisition Regulation (FAR) - codified at Title 48 of the Code of Federal Regulations - containing the uniform policies and procedures for acquisitions by the U.S. Government. Although many agencies supplement the FAR with their own requirements, the FAR represents an effort by Congress to create a uniform framework for contracting with agencies of the Executive Branch.

Recently, the FAR was amended with a Final Rule that will require contractors to meet specific ethics and compliance-oriented requirements, including:

1. a written contractor code of business ethics and conduct; and
2. the display of Fraud Hotline Posters as required by the agency Office of the Inspector General (OIG).

The requirements become effective on December 24, 2007, and are triggered by government contracts meeting certain thresholds. Following a period of industry comment, the Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (the "Councils") issued these FAR amendments in FAR Case 2006-007 and published a Final Rule in the Federal Register. See 72 Fed. Reg. 65873. More may be coming. A Proposed Rule (FAR case 2007-006) that will provide additional compliance-specific requirements, including a duty to notify the government whenever contractors become aware of violations of Federal criminal law, is pending.

Many reasons have been suggested for this movement towards greater compliance and self-reporting in the contractor community. A desire to adopt best practices for corporate governance similar to those imposed on public corporations as a result of the Sarbanes-Oxley Act of 2002 probably is among them. The new Rule may also signal a reaction to government contract scandals, particularly those that have received much media attention during the Iraq War effort. There is also a suggestion in the Rule that these new mandates are in line with existing requirements for government contractors, particularly those requiring contractors to have a "satisfactory record of integrity and business ethics." Whatever the inducement, it is clear that the FAR amendments now impose express requirements for a written code of ethics and business conduct, an employee awareness program, and internal reporting and control mechanisms.

These new requirements apply to contractors that receive any contract award "expected to exceed" $5 million with a performance period of 120 days or more. If those thresholds are met, a written code of business ethics and conduct will be mandatory. It will be imposed on contractors by new language in the mandated solicitation and contract clauses (FAR 52.203-13). These new clauses, in substance, will require that contractors have a written code of business ethics and conduct, that such codes be distributed to employees performing the contract, and that there be an awareness program along with an internal control system. Firms that represent themselves as a small business in connection with the contract will be exempt from the awareness program and internal control system requirements.

In the comments section of the published Final Rule, the Councils stated that "[t]he rule is not applicable to existing contracts." Thus, the requirements appear to be prospective and apply only to new contracts awarded on or after December 24, 2007, thereby providing some relief to those contractors not quite prepared to comply with these new requirements by Christmas Eve.

The New Requirements

The specific FAR requirements for the code of business ethics and conduct include that it be:

1. in writing;
2. issued within 30 days of the contract award (unless the contracting officer establishes a longer time period);
3. provided to each employee engaged in performance of the contract; and
4. that the contractor "promote" compliance with its code of business ethics and conduct.

The FAR does not specify the requirements of an awareness program. The regulations merely provide that the contractor shall establish, within 90 days after contract award (unless the contracting officer establishes a longer time period), an "ongoing business ethics and business conduct awareness program."

In terms of the internal control system, the amendments provide that the contractor's internal control system shall:

1. facilitate timely discovery of improper conduct in connection with government contracts; and
2. ensure corrective measures are promptly instituted and carried out.

Examples of these measures include:

1. Periodic reviews of company business practices, procedures, policies, and internal controls for compliance with the contractor's code of business ethics and conduct and the special requirements of government contracting;
2. An internal reporting mechanism, such as a hotline, by which employees may report suspected instances of improper conduct, and instructions that encourage employees to make such reports;
3. Internal and/or external audits, as appropriate; and
4. Disciplinary action for improper conduct.

With respect to Hotline posters, the Rule requires that contractors display agency fraud hotline posters as required by the contracting officer. However, to the extent that the contractor has implemented a business ethics and conduct awareness program, including a reporting mechanism, the contractor need not display the agency posters other than certain required posters by the Department of Homeland Security.

The Exceptions

Small businesses are subject to the requirement of a written code of business ethics and conduct for those contracts that are greater than $5 million and will take greater than 120 days to perform. They are relieved, however, from the requirement to implement an employee awareness program and an internal control system. The Councils included this exemption in response to concerns from the small business community during the comment period. The Small Business Administration estimated that the costs associated with an ethics program and an internal control system would exceed $10,000.

Commercial Item contracts are exempt from the requirements of the new Rule in accordance with well-established FAR rules that require the acquisition of commercial items to resemble customarily commercial marketplace practices to the maximum extent practicable. The Councils determined that commercial practices encourage, but do not require, contractor codes of business ethics and conduct.

Contracts performed entirely outside the United States (including the District of Columbia and outlying areas) are exempt from the requirements of the Final Rule.

The Impending New Rules

As mentioned above, the Councils have issued a Proposed Rule (FAR Case 2007-006) with additional compliance-based requirements. This Proposed Rule is subject to a public comment period that will close on January 14, 2008. Much of the content of this Proposed Rule is in response to a Department of Justice request for greater government contractor compliance and recommendations from a DOJ Procurement Fraud Task Force "white paper". This Proposed Rule imposes additional requirements regarding codes of business ethics and conduct, including notification requirements for contractors upon becoming aware of violations of federal law. Also notable in the Proposed Rule is the alignment of the contractor compliance requirements with the U.S. Sentencing Commission Guidelines Manual, which provides specific guidance on what the Councils consider to be an effective ethics and compliance program.

Recommended Next Steps

For government contractors, we recommend as follows:

1. Determine whether your firm is subject to, or likely to be subject to, the new Final Rule given the government contracts that you expect to bid for in the immediate future. If these anticipated contracts meet the thresholds, proceed with a compliance implementation plan.
2. Determine whether your firm qualifies as a small business in accordance with SBA guidelines. If so, determine whether to take advantage of the exemptions within the new Rule.
3. Develop a Contractor Compliance Implementation Plan that includes some or all of the items below:
   1. Identify key individuals within your organization that will provide input and review the proposed drafts of a code. These may include members of Human Resources, Compliance, Law, Controller/Finance, and a senior member of management. Ultimately, a code of ethics and business conduct is a collection of required policies, tailored to the specifics of the organization and written in a fashion that takes into account the culture of the firm. In order for a code to have impact and become a part of the culture, it is imperative that the code not be merely bought or copied from other sources. While there are many resources that will help draft a code, the best codes reflect the values and culture of the particular firm and incorporate realistic business scenarios that are applicable to the particulars of the firm.
   2. If you have not already done so, consider establishing a Compliance Officer who will have ultimate responsibility for managing the code of business ethics and conduct, for reporting on adherence to the code on a regular basis to senior management and/or the board, and for maintaining employee awareness about the code.
   3. Inventory your current policies - including existing codes of conduct, human resources policies, finance/accounting protocols. You may be able to avoid "re-inventing the wheel" by drawing on many of your current policies.
   4. Design a hotline/whistleblower system for employees to report concerns of workplace misconduct including compliance issues and illegal activity. Determine whether an internal or external hotline system is best. Determine whether you need an ombudsman that can manage such calls on a confidential basis.
   5. Establish a training program for the code of business ethics and conduct. Depending on the size and geographic footprint of your firm, you may be able to provide live training, online training, or a combination of both.
   6. Determine a communications and implementation plan. Communicate the code by various means that provide communication to different levels of the organization - a CEO town hall, an e-mail communication to all employees, new employee training and orientation, annual employee certifications, worksite posters, supervisor team meetings, and so on.
   7. Re-visit on an annual basis how best to maintain awareness of the code of business ethics and conduct.
4. Consider the Proposed Rule and the U.S. Sentencing Guidelines: In light of the Proposed Rule, which will likely lead to additional requirements, we recommend that firms consider adopting the more rigorous and specific requirements of the Sentencing Guidelines. In many respects, these guidelines provide a framework for best-practice corporate governance and as such can provide much value to a firm regardless of whether all elements are specifically required by the FAR.

Final Thoughts

While the newly issued Final Rule may seem burdensome, all public companies listed on a U.S. stock exchange have had to grapple with similar and even more onerous requirements imposed by the Sarbanes-Oxley Act of 2002. Many of these requirements have helped firms develop best practice compliance organizations and have led to the development of improved corporate governance. We recommend that government contractors take a long term view of these requirements and strive to meet not only the Rule that will be effective later this month, but also the Proposed Rule that is likely to be final in the future.

Related Links
Federal Register FAR 2006-007 [86 KB] Federal Register FAR 2007-006 Proposed Rule [65 KB]