FAR Council Issues Final Rule on Contractor Ethics Program

By Susan J. Moser, Cherry, Bekaert & Holland, L.L.P. (CB&H)
Email: smoser@cbh.com

On November 23, 2007, the FAR Council published a final rule as part of FAC 2005-22, effective December 24, 2007, imposing new ethics requirements on contractors. The new rule also promulgated a government-wide requirement for contractors to post agency Inspector General Hotline posters in contractor workplaces.

Significantly, the final rule deletes two of the most controversial provisions that were in the proposed rule published on February 16, 2007. Those provisions would have required contractors to self disclose any wrongdoing by the contractor or its employees in regard to the contract, including any criminal activity, and a requirement to cooperate fully in any investigation, audit or inquiry regarding a contract. Although these provisions were dropped from the final rule, they were merely moved to a new FAR case 2007-006 for further analysis.

The final rule creates a new subpart 3.10, Contractor Code of Business Ethics and Conduct. The new FAR 3.1002 states that it is the government’s policy that contractors should have a written code of business ethics and conduct. To promote compliance with such a code of ethics, contractors should have an employee business ethics and compliance training program and an internal control system that are suitable to the size of the company and extent of the contractor’s involvement in government contracting.

Further, this training program and internal control system should facilitate the timely discovery and disclosure of improper conduct in connection with government contracts and ensure corrective measures are instituted and carried out promptly. Note that this provision uses the word “should.” This denotes a desired outcome, but does not make all of these requirements mandatory. What is binding for contractors is in the new clause promulgated to carry out this policy.

To implement this policy contractually, a new contract clause, FAR 52.203-13, Contractor Code of Business Ethics and Conduct, has been promulgated. This clause is to be inserted in all contracts that exceed five million dollars and are expected to have a performance period of at least 120 days, except those for commercial items and those that are to be performed entirely outside the United States.

Under paragraph (b) of this clause, within 30 days after contract award, or a longer period established by the contracting officer, the contractor is required to have a written code of business ethics and conduct and provide a copy of that code to each employee performing on the contract. Additionally, the contractor is required to promote compliance with its code of ethics.

Paragraph (c) of the clause does not apply to small business concerns, but applies only to concerns that are other than small businesses, including universities and nonprofits. It requires the contractor to establish, within 90 days after contract award, or such longer period as the contracting officer may establish, an ongoing business ethics and business conduct awareness program and an internal control system.

This internal control system must facilitate timely discovery and disclosure of improper conduct in connection with government contracts and ensure that corrective measures are instituted and carried out promptly. The clause goes on to list four examples of characteristics the internal control system should exhibit.

Significantly, the clause does not require the contractor to submit its code of ethics, its ethics awareness program or its internal control system to the government for approval. Instead, the Federal Register notice clearly states that none of these should be a deliverable under a contract, and that the government’s responsibility is merely to ensure that the contractor has the required programs and systems.

The adequacy of these programs would only come into question if a problem arises, such as the contractor being proposed for suspension or debarment. However, one part of a DCAA audit is to review the contractor’s internal controls as they relate to an area of vulnerability. Accordingly, we would not be surprised to see DCAA auditors commenting upon a contractor’s internal control systems and their adequacy, even when the contractor is a small business and is not required to have an internal control system that meets the requirements of this new clause.

Paragraph (d) makes the clause a flow-down clause for all subcontracts that exceed $5 million and have a performance period of at least 120 days, except those for commercial items and those that are to be performed entirely outside the United States. Neither the clause nor subpart 3.10 defines a “subcontract.” However, the promulgation comments state that the term includes purchase orders.
As with prime contracts, the subcontractor does not have to submit its code of ethics, ethics awareness program, or internal control system to the prime contractor for review. All the prime contractor has to do is confirm that the subcontractor has such programs in place.

In addition to promulgating 52.203-13, the FAC also contains a new FAR 52.203-14, Display of Hotline Posters. Under this clause, the contractor is required to display any fraud hotline poster identified in the clause. However, the contractor does not have to display such posters, except as required by the Department of Homeland Security, if the contractor has implemented a business ethics and conduct awareness program, including a reporting mechanism, which would include a hotline poster of its own.

Susan is a Partner with CB&H and a member of the Firm's Government Contractor Services Group.