A new regulatory enforcement regime has now commenced that underscores the Department of Justice’s aggressive approach to procurement fraud and dramatically increases the compliance and disclosure obligations of defense contractors.
On Dec. 12, 2008, an amendment to the Federal Acquisition Regulation (FAR) took effect that requires all contractors to timely disclose certain violations of law and overpayments to the government on penalty of suspension and debarment. The new disclosure requirement comes approximately one year after another ethics regulation took effect that requires contractors in certain procurements to establish and implement a code of business ethics and conduct, as well as an extensive internal control system.
Defense contractors also face additional disclosure requirements stemming from the Defense Authorization Act for fiscal year 2009, which will soon require many of them to submit semi-annual reports to the Defense Department that contain specified information for inclusion in an electronic database regarding prior adverse actions or findings of contractor misconduct.
All contractors, regardless of their size or the value of the procurement, must now make a “timely” written disclosure to the office of inspector general at the agency that awarded the contract — with a copy to the contracting officer — whenever, in connection with an award, performance, or closeout of a contract or subcontract, the contractor has “credible evidence” that a principal, employee, agent, or subcontractor has committed a violation of federal criminal law involving fraud, conflict of interest, bribery, or illegal gratuities; or a violation of the civil False Claims Act. Contractors are already obligated to report overpayments under pre-existing payments provisions in the FAR.
The mandatory disclosure requirement applies both to acquisitions of commercial items and to contracts performed outside of the United States. In addition, it applies to subcontractors as well as prime contractors.
The regulation contains a daunting enforcement mechanism for non-compliance with the new disclosure requirement. Specifically, any contractor or subcontractor may be suspended or debarred upon the “knowing” failure by a “principal” to timely disclose to the government “credible evidence” of the following: a violation of federal criminal law involving fraud, conflict of interest, bribery, or illegal gratuities; a violation of the civil False Claims Act; or “significant overpayments” on a contract. Debarment in the event of non-disclosure is not a certainty, however. The 10 mitigating factors set forth in FAR 9.406-1(a) will continue to apply to determine whether debarment should occur.
The disclosure obligation continues until three years after final payment on a contract. In addition, contractors must disclose known violations relating to an ongoing contract even if they occurred prior to Dec. 12, 2008, the effective date of the regulation. The knowing failure to disclose specified violations remains a cause of action for suspension and debarment for three years after final payment on a contract.
These are the FAR Councils’ definition of key terms: Principal. A “principal” is broadly defined in the regulation to include “an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity,” such as a general manager, plant manager, or the head of a subsidiary, division, or business segment. The FAR Councils stressed that the “definition should be interpreted broadly, and could include compliance officers or directors of internal audit, as well as other positions of responsibility.”
Credible Evidence. The FAR Councils expressly noted that until the contractor has determined the evidence to be credible, there can be no “knowing failure to timely disclose.” In addition, it is unlikely that any contractor would be suspended or debarred “absent the determination that a violation had actually occurred.” However, the term “credible evidence,” is not defined in the regulation. The FAR Councils commented that “credible evidence” is a higher standard than “reasonable grounds to believe” and that it implies that the contractor will have the opportunity to take some time for preliminary examination of the evidence to “determine its credibility for deciding to disclose to the government.”
Knowing. The FAR Councils declined to define “knowing” in the context of a “knowing failure to disclose.” In a tautological observation, they commented only that “knowing” refers to “the failure to disclose,” adding that “principals are only required to disclose what they know.”
Timely. The FAR Councils explained that timeliness is measured from the date the contractor determines that evidence is credible, or, in a case where credible evidence of a violation was known prior to contract award, from the Dec. 12 effective date of the rule. A contractor has “some time for preliminary examination of the evidence to determine its credibility before deciding to disclose to the government.” Contractors are not obligated to conduct a “complex investigation,” and are expected to take only “reasonable steps” that they “consider sufficient to determine that the evidence is credible.” The relevant IG or contracting officer is expected to encourage the contractor to complete its internal investigation.
Overpayment. The FAR Councils declined to define “overpayment,” instead referring respondents to existing descriptions of overpayments in current FAR provisions. They did indicate that de minimis overpayments will not trigger the disclosure requirement. This rule is aimed at the type of overpayment that the contractor knows will result in “unjust enrichment, and yet fails to disclose it.” The term “significant” implies more than just dollar value and depends on the circumstances of the overpayment as well as the amount.
Flowdown Obligations. Although a prime contractor could face sanctions in connection with misconduct by a subcontractor, the FAR Councils said the prime contractor is subject to debarment only if it fails to disclose known violations by the subcontractor. A prime contractor is not required to review or approve a subcontractor’s code of ethics or internal control system; rather, it must only verify that the subcontractor has them.
The regulation mandates several minimum standards for the internal control system required of large contractors. First, the contractor must assign responsibility at a sufficiently high level within the organization, and provide adequate resources, to ensure the effectiveness of its business ethics awareness and internal control system.
Second, it must make “reasonable efforts” not to include principals within the organization whom due diligence would have exposed as having engaged in conduct that is illegal or in conflict with the contractor’s code of business ethics and conduct.
Third, the contractor must conduct periodic reviews of company business practices, procedures, policies, and internal controls to assess compliance with its code of business ethics and conduct.
Fourth, contractors must establish an internal reporting mechanism that allows for anonymity or confidentiality, such as a hotline, and must instruct employees on how to use it.
Fifth, contractors must institute disciplinary action for “improper conduct” (a lower threshold than a violation of law), or for failing to take reasonable steps to prevent or detect “improper conduct.”
Sixth, contractors must comply with the “timely disclosure” requirements detailed above. Finally, a contractor must provide “full cooperation” to any government agencies responsible for an audit, investigation or corrective action.
The issue of what constitutes “full cooperation” merits attention. The term is defined as “disclosure to the government of the information sufficient for law enforcement to identify the nature and extent of the offense and the individuals responsible for the conduct.” In response to numerous public comments, the FAR Councils explained that “full cooperation” does not prevent a contractor from conducting an internal investigation or defending a proceeding or dispute arising under a contract or related to a potential or disclosed violation.
They remarked that “full cooperation” includes providing timely and complete responses to government auditors and investigators and access to employees with information, adding that it is “reasonable to expect” that compliant contractors will encourage employees both to make themselves available to investigators and prosecutors, and to cooperate with the government’s investigation.
In an ominous warning indicative of the risk of criminal prosecution looming over the new ethics regime, the FAR Councils noted that “ignoring or offering little attention to detail in responding to auditor or investigator requests or subpoenas for documents or information may, in some circumstances, be obstruction of justice.”
Full cooperation does not require a waiver by a contractor of the attorney-client privilege or protections of the attorney work-product doctrine. Nor does it require an officer, director, owner, or employee to waive their attorney-client privilege or Fifth Amendment rights.
The disclosure mandated by the new regulation will soon be augmented by additional requirements contained in the Defense Federal Acquisition Regulation Supplement (DFARS).
The Defense Authorization Act for fiscal 2009 requires the Defense Department to establish a contractor integrity database, for contracts valued at more than $500,000 and for a period of the past five years. The database will include prior federal and state criminal convictions regarding contract award or performance; each federal suspension and debarment; each federal contract and grant that was terminated due to default; findings of civil liability resulting in a monetary fine, penalty, reimbursement, restitution, or damages of $5,000 or more; findings of administrative liability; settlement agreements; and prior findings that a contractor was not a “responsible source.”
Before Defense may make a contract award, a department official must review the database. In addition, the DFARS must be amended to require contractors with total contracts valued at more than $10 million to submit semi-annual reports to the Defense Department that include the information subject to inclusion in the database.
The FAR Council’s responses to public comments shed some light on how the new mandatory disclosure rules will be applied. But several issues await further illumination. It is unclear whether companies that disclose violations to the government will continue to receive credit for cooperation in a debarment proceeding or in a criminal prosecution. The determination of what constitutes “credible evidence” will likely be a subjective assessment particular to a given case, impacted by such variables as documentary proof of a violation and the quality and extent of witness statements and other corroborating evidence.
Only with experience will empirical benchmarks develop that provide more visible guidelines. It also remains uncertain how much latitude contractors will be given to engage in fact-finding activities in order to satisfy the timeliness element of the new disclosure standard.
For now, contractors would be wise to undertake, at a minimum, the following prudential measures.
• They should reexamine existing codes of business conduct and ethics, and existing internal control systems, to ensure they comply with the new rules.
• Training of company personnel on the new rules — from principals down to accounting personnel and administrative staff engaged in contract administration — should be accomplished as soon as possible. In the event of a problem, government auditors and investigators will be examining, among other things, whether the contractor merely has a compliance program on paper or has meaningfully implemented it.
• Companies should consider instituting incentives to report violations — both to strengthen their existing ethics culture and to facilitate timely disclosure of violations to the government. In that regard, contractors should reexamine the adequacy of hotline procedures and other existing reporting mechanisms to ensure that they provide a reliable and confidential means for personnel to report violations, and that employee reports of violations are acted on promptly.
• Prime contractors should ensure that prospective subcontracts contain the requisite ethics clauses and should obtain a written certification from subcontractors that they have the required ethics code and internal control procedures.
David H. Laufman is a partner at Kelley Drye & Warren LLP, Washington, D.C.
EDITOR’S NOTE: National Defense Magazine’s monthly “
Ethics Corner"provides additional analysis on the topic covered in this article.