What?
Amendments to the Federal Acquisition Regulations (FAR) now affirmatively require most companies doing business directly or indirectly with the federal government to: (1) adopt a code of business ethics and conduct (“Code”), and (2) educate all employees on its provisions.
Who?
FAR 3.10, FAR 52.203-13 and FAR 52.203-14 apply to government contracts of at least $5,000,000, and which require at least 120 days to perform.
How?
The new regulations require both an employee awareness program, as well as a robust internal audit program.
When?
Effective December 24, 2007.
Government Contractors Face Substantial Requirements
The new FAR rules are noteworthy for requiring both an employee awareness program and a robust internal audit program. Specifically, the regulations provide that an employee training program should extend to all employees, and represent an “ongoing” effort to ensure that employees both know and understand their obligations under their employer’s Code.
Likewise, the regulations require affected contractors to institute internal controls, including suggested “periodic reviews of company business practices, procedures, policies and internal controls.” This make a robust ethics and code of conduct program an absolute essential for employers doing even modest business with the federal government.
The new FAR requirements will sound very familiar to those in the private sector. Most organizations adopted Codes of Conduct and ancillary ethics training programs following the passage of the Sarbanes-Oxley Act in 2002, and amendments to the Federal Sentencing Guidelines in 2004. The FAR rules emphasize the need for an ongoing program, as well as the requirement to reach out to all employees. These requirements codify what we view as best practices for all organizations – whether doing business with the government or not.
The complete text of the new FAR requirements can be found at http://acquisition.gov/far/current/html/Subpart%203_10.html and http://acquisition.gov/far/current/html/52_200_206.html.
A summary of the key rules follows:
Which Government Contractors Are Affected?
The new FAR requirements generally apply to any government contract worth at least $5,000,000 and which requires at least 120 days to perform. They also apply with minor exceptions to subcontractors providing services under the affected contracts.
How Does the Timing Work?
- Within 30 days* of entering into a government contract, contractors must:
- Adopt a written code of business ethics and conduct;
- Provide a copy of the Code to each employee engaged in the performance of the government contract; and
- Promote compliance with the adopted Code.
*This time may be extended by the contacting officer and the requirement does not apply to existing contracts that were awarded before December 24, 2007, or to task orders awarded under those contracts.
- Within 90 days of entering into a government contract, contractors must:
- Establish an “ongoing business ethics and business conduct awareness program; and
- Establish an internal control program aimed at:
- The timely discovery of improper conduct; and
- Ensuring corrective measures are taken.
What Kind of Employee Training and Audit Programs Are Required?
In general, the regulations provide that government contractors must adopt (1) employee business ethics and compliance training, and (2) internal audit programs:
- That are suitable to the size of the company and extent of its involvement in Government contracting.
- That facilitate the timely discovery and disclosure of improper conduct in connection with Government contracts
- That ensure corrective measures are taken.
For details on available online training and awareness programs, go to ELT’s ethics training resources.
Do We Also Need to Display Hotline Posters?
Probably not.
Under FAR 52.203-14, if a contractor has implemented a business ethics and conduct awareness program, including a reporting mechanism (such as a hotline), then the contractor does not need to display any agency fraud hotline posters, other than any required DHS posters.
If a contractor has not implemented a business ethics and conduct awareness program, it must display a government agency or Department of Homeland Security-approved fraud hotline poster (available from the official Contracting Officer). This requirement will most likely apply to small businesses that are not required to follow the training and internal control rules. (See exceptions below.)
What Happens if We Don’t Comply?
Contractors that fail to comply with these new requirements could face withheld payments, loss of fee award, or even debarment, suspension or other disciplinary action.
Are There Any Exceptions to the New FAR Requirements?
Yes.
The regulations do not apply when the contracts are awarded under the FAR Part 12 commercial item contracts clause, or when the contract will be performed outside of the United States, the District of Columbia, and outlying areas.
In terms of a partial exception, contractors that have represented themselves as small business concerns during the contracting process are excluded from the formal training program and internal control requirements.
These exceptions also flow through to subcontractors.
Could There Be Additional Changes to the new FAR Requirements?
Yes.
At the request of the DOJ, a supplement to the Code is under consideration. The proposed additional rule was published on November 14, 2007 and the deadline for comments was January 14, 2008.
This Proposed Rule imposes additional requirements regarding codes of business ethics and conduct, including notification requirements for contractors upon becoming aware of violations of federal law. The Proposed Rule appears to be consistent with the contractor compliance requirements in U.S. Sentencing Commission Guidelines Manual, which provide specific guidance on what the FAR Councils consider to be an effective ethics and compliance program.
It is anticipated that these additional requirements will be approved. Stay tuned to ELT’s website and blog for more updates.
What Should We Do Now?
If your organization does business with the federal government, you need to immediately determine whether you have current or prospective contracts valued over $5,000,000.
If you meet the threshold, it’s imperative to create a robust and easy-to-understand Code. If you already have a Code, you should consider reviewing and updating it. The new regulations require “periodic reviews of company business practices, procedures, policies and internal controls.” A Code should be a living document that reflects the ongoing needs and challenges of your business, as well as changes in the law.
The Code then needs to be widely distributed to your employees. The distribution requirement dovetails nicely with the requirement to establish “ongoing business ethics and business conduct awareness program.” The most effective way to communicate the Code, and to bring it to life, is to include it as part of your enterprise-wide training program. With online education, the Code can be seamlessly delivered and tracked, along with the training.
Finally, you need to establish an “internal control program.” Don’t let this sound more complicated than it needs to be. The intent of the new FAR requirements is for companies to be able to discover improper conduct, and to take corrective action when they do. In short, you need to have an effective complaint and investigation procedure. This is likely something already well established at your organization. The key is for employees to know about it – in other words, make sure that it’s well publicized through your training programs and other forms of internal communications (intranet, periodic e-mail announcements etc.)
Now here’s a reality check for those of you hoping to fit the exceptions. Even if you’re not technically covered by the new FAR requirements, it is still highly advisable to follow these new rules. Not only do they reflect the key components of the Federal Sentencing Guidelines (which almost every employer needs to follow), they represent basic best practices when it comes to risk management, and fostering a culture of compliance.
The trend of Code adoption and ethics training is only continuing to build momentum. In the coming months and years, we’re likely to see more of these types of regulations -- impacting employers of all sizes and types, and across all industries.
For more information about online training and awareness programs, go to ELT’s ethics training resources.