Detailed FAR Training Requirements
New Fed Rules Require Contractors to Adopt Codes of Conduct and Implement Ongoing Ethics Training
What: Amendments to the Federal Acquisition Regulations (FAR) now affirmatively require most companies doing business directly or indirectly with the federal government to: (1) adopt a code of business ethics and conduct ("Code"), and (2) educate all employees on its provisions.
Who: FAR 3.10, FAR 52.203-13 and FAR 52.203-14 apply to government contracts of at least $5,000,000, and which require at least 120 days to perform.
How?: The new regulations require an "effective" employee awareness program that trains all "principals and employees" on your Code of Conduct. It also requires employers to implement a robust internal audit program.
When: The amendments first mandating employee awareness and internal programs became effective on December 24, 2007.
Newest Changes: On December 12, 2008, FAR was again amended with new rules that give contractors detailed guidance on the kinds of training and audit programs required for compliance. They are expressly designed to more closely align the requirements of the FAR amendments, with similar requirements under the Federal Sentencing Guidelines.
The December 2008 amendments also affirmatively require contractors to disclose whenever they have reasonable grounds to believe there has been a violation of federal law in connection with the award or performance of a government contract.
The substance of the requirements was set forth in a Proposed Rule issued November 14, 2007 and modified slightly on May 16, 2008. The comment period on the Proposed Rule setting forth the requirements closed in January 2008. The comment period on the modifications ends July 15, 2008.
Government Contractors Face Substantial Requirements
The December 2007 and December 2008 FAR amendments are noteworthy for requiring both an employee awareness program and a robust internal audit program. Specifically, the regulations provide that an employee training program:
- Should extend to all employees; and
- Represent an "ongoing" effort to ensure that employees both know and understand their obligations under their employer's Code.
Likewise, the regulations require affected contractors to institute internal controls, including suggested "periodic reviews of company business practices, procedures, policies and internal controls." This makes a robust ethics and code of conduct program an absolute essential for employers doing even modest business with the federal government.
The new FAR requirements will sound very familiar to those in the private sector. Most organizations adopted Codes of Conduct and ancillary ethics training programs following the passage of the Sarbanes-Oxley Act in 2002, and amendments to the Federal Sentencing Guidelines in 2004. The FAR rules emphasize the need for an ongoing program, as well as the requirement to reach out to all employees. These requirements codify what we view as best practices for all organizations - whether doing business with the government or not.
The complete text of the new FAR requirements can be found at the following links:
http://acquisition.gov/far/current/html/Subpart%203_10.html
http://acquisition.gov/far/current/html/52_200_206.html
http://www.regulations.gov/fdmspublic/component/main?main=DocumentDetail&o=09000064807a4de3
December 12, 2008 Amendments Provide Further Guidance and Impose Additional Requirements
On December 12, 2008, FAR was further amended to specifically define elements of the mandated compliance programs, and require contractors to disclose suspected criminal conduct in connection with government contracts. They supplement the December 2007 regulations, and provide contractors with more detailed guidance on how to meet their training and compliance obligations.
- With respect to Code of Conduct training, the new amendments seek to bring the FAR requirements into closer alignment with the requirements of the Federal Sentencing Guidelines. Training must:
- Be periodic, and appropriate to each individual's duties.
- Go to all "principals and employees" and where appropriate, to all "agents and subcontractors."
- With respect to Internal Control Systems, the new amendments identify additional, mandatory elements of an effective program.
The December 2008 Amendments also create a new "self-reporting" obligation for contractors. Specifically, the new amendments would require contractors to disclose in writing to the government whenever they have reasonable grounds to believe that a principal, employee, agent or subcontractor has violated the False Claims Act or other provisions of federal law relating to the award or performance of a government contract.
These requirements are in line with widely recognized compliance training best practices. They likewise make clear that organizations must do more than give lip service to satisfy the new training requirements -- and that "check the box" Code training programs will simply not be enough. Indeed, the amendments expressly impose on contractors a duty to "promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law."
A summary of the key elements in the final December 2007 and December 2008 FAR amendments are as follows:
The December 2007 Amendments to FAR
Which Government Contractors Are Affected?
The FAR requirements generally apply to any government contract worth at least $5,000,000 and which requires at least 120 days to perform, regardless of which government contracting agency is involved in the contract. The amendments also apply with minor exceptions to subcontractors providing services under the affected contracts.
How Does the Timing Work?
Within 30 days* of entering into a government contract, contractors must:
- Adopt a written code of business ethics and conduct;
- Provide a copy of the Code to employees; and
- Promote compliance with the adopted Code.
Within 90 days* of entering into a government contract (unless expressly extended by the Contracting Officer), contractors must:
- Establish an "ongoing business ethics and business conduct awareness program" for employees; and
- Establish an internal control program aimed at:
- The "timely discovery" of improper conduct; and
- Ensuring "corrective measures" are "promptly instituted and carried out."
*These periods may be extended by the contracting officer and the requirement does not apply to existing contracts that were awarded before December 24, 2007, or to task orders awarded under those contracts.
What Kind of Employee Training Programs Are Required?
In general, the regulations provide that government contractors must adopt (1) employee business ethics and compliance training, and (2) internal audit programs that:
- Are suitable to the size of the company and extent of its involvement in Government contracting.
- Facilitate the timely discovery and disclosure of improper conduct in connection with government contracts
- Ensure corrective measures are taken.
For details on available online training and awareness programs, go to ELT's ethics training resources.
Do We Also Need to Display Hotline Posters?
Probably not.
Under FAR 52.203-14, if a contractor has implemented a business ethics and conduct awareness program, including a reporting mechanism (such as a hotline), then the contractor does not need to display any agency fraud hotline posters, other than any required DHS posters.
If a contractor has not implemented a business ethics and conduct awareness program, it must display a government agency or Department of Homeland Security-approved fraud hotline poster (available from the official Contracting Officer). This requirement will most likely apply to small businesses that are not required to follow the training and internal control rules. (See exceptions below.)
What Happens if We Don't Comply?
Contractors that fail to comply with these new requirements could face withheld payments, loss of fee award, or even debarment, suspension or other disciplinary action.
Are There Any Exceptions to the New FAR Requirements?
Yes. Contractors that have represented themselves as small business concerns during the contracting process are excluded from the formal training program and internal control requirements.
Additional exceptions were originally available under the December 2007 amendments for contracts are awarded under the FAR Part 12 commercial item contracts clause and for contracts to be performed outside of the United States. However, Congress expressly revoked these exceptions in the December 2008 amendments. This has greatly extended the reach of the amendments - making it imperative for virtually all government contractors to implement effective employee awareness and internal audit programs.
The December 2008 Amendments to FAR
What Do the December 2008 Amendments Cover?
The December 2008 Amendments provide greater detail regarding contractor compliance obligations and supplement, rather than replace, the 2007 amendments. The December 2008 requirements with respect to Code of Conduct training are expressly intended to align Code training requirements under FAR with similar requirements imposed under the Federal Sentencing Guidelines.
The December 2008 Amendments also require contractors to affirmatively report when they have reasonable grounds to believe there has been a criminal violation in connection with the award or performance of a government contract.
How Do Ethical Violations Impact Contractors under the December 2008 Amendments?
The December 2008 Amendments provide that ethical violations will be considered in the past performance evaluations of bidding companies. They also provide that contractors can be suspended and/or debarred for a "knowing failure" to timely disclose:
- A violation of "Federal criminal law involving fraud, conflict of interest, bribery or gratuity" rules; or
- A violation of the False Claims Act.
What Are the December 2008 Amendments' Additional Training Requirements?
The December 2008 Amendments further confirm the breadth and scope of the required training. They prescribe a wide-ranging, comprehensive training program and dispel any notion that half-hearted training efforts are sufficient to meet the proposed standards.
Specifically, the December 2008 Amendments provide that:
Affected organizations must include reasonable steps to "periodically" communicate their standards and procedures and other aspects of their business ethics awareness and compliance program and internal control system.
The December 2008 Amendments do not specifically define how often training must be provided. However, case law in the context of harassment training and widely accepted training practices under the Federal Sentencing Guidelines strongly suggest that training must be provided every 12 to 24 months.
The training must be "effective" in disseminating information appropriate to each individual's "roles and responsibilities."
The training must be provided to all "principals and employees" and, as appropriate, the contractor's agents and subcontractors. This confirms that contractors may not skirt their training obligations by limiting training to those employees specifically tasked with performance of the government contract.
What Are the December 2008 Amendments' Additional Guidelines Regarding Internal Control Systems?
The December 2008 Amendments also provide much greater detail regarding what Internal Control Systems should include, how they should aid in the discovery of improper conduct, and the kinds of corrective measures that should be taken.
Among other things, the December 2008 Amendments provide that Internal Control Systems should include standards and procedures to facilitate the timely discovery of improper conduct and ensure that corrective measures are promptly instituted and carried out.
They also provide that Internal Control Systems should provide for the following:
Assignment responsibility at a sufficiently high level in the organization to ensure adequate resources are provided for both the training and internal control system.
Reasonable efforts to ensure that a contractor's leaders including officers, directors, owners and others with primary management responsibility have not engaged in illegal conduct or conduct which violates the contractor's Code of Conduct.
Periodic reviews of company practices, procedures, policies and internal compliance controls, including:
o Monitoring and auditing activities to detect criminal conduct.
o Periodic reviews of the effectiveness of the company's training and internal control programs.
o Periodic assessments of risk with appropriate steps to design, implement or modify the compliance training program and internal control system to reduce the identified risk.
A confidential / anonymous internal "hotline" or other reporting mechanism.
Disciplinary action for improper conduct or for failing to take reasonable steps to prevent or detect improper conduct.
Do the December 2008 Amendments Require Companies to Voluntarily Disclose Potential Violations of Federal Law?
Yes.
The December 2008 Amendments provide that affected companies must "timely disclose in writing" to the agency Office of the Inspector General whenever they have reasonable grounds to believe that there has been a violation of the False Claims Act or other provisions of federal law relating to the award or performance of a government contract.
Whose Misconduct Must Be Reported Under the December 2008 Amendments?
The self-disclosure requirements are very broad under the December 2008 Amendments. The Rules provide that affected companies must disclose whenever they have reasonable grounds to believe there has been a violation of the False Claims Act or other federal law relating to the award or performance of a federal contract.
What Should We Do Now?
If your organization does business with the federal government, you need to immediately determine whether you have current or prospective contracts valued over $5,000,000.
If you meet the threshold, it's imperative to create a robust and easy-to-understand Code. If you already have a Code, you should consider reviewing and updating it. The new regulations require "periodic reviews of company business practices, procedures, policies and internal controls." A Code should be a living document that reflects the ongoing needs and challenges of your business, as well as changes in the law.
The Code then needs to be widely distributed to your employees. The distribution requirement dove tails nicely with the requirement to establish "ongoing business ethics and business conduct awareness program." The most effective way to communicate the Code, and to bring it to life, is to include it as part of your enterprise-wide training program. With online education, the Code can be seamlessly delivered and tracked, along with the training.
Finally, you need to establish an "internal control program." Don't let this sound more complicated than it needs to be. The intent of the new FAR requirements is for companies to be able to discover improper conduct, and to take corrective action when they do. In short, you need to have an effective complaint and investigation procedure. This is likely something already well established at your organization.
The key is for employees to know about your complaint and investigation procedure - in other words, make sure that it's well publicized through your training programs and other forms of internal communications (intranet, periodic e-mail announcements etc.).
The other critical component is to have appropriate resources on hand to review complaints / reports, and to execute the appropriate follow up, which may include formal investigation and corrective action. These resources should also be monitoring: (1) the ongoing effectiveness of your training program (completion rates and employee awareness are key), and (2) the ongoing effectiveness of the complaint and investigation procedure (complaint processing times and resolution are key). Of course information gleaned from this periodic monitoring should inform the ongoing development of both your training program, as well as your internal control program.
Now here's a reality check for those of you hoping to fit the exceptions. Even if you're not technically covered by the new FAR requirements, it is still highly advisable to follow these new rules. Not only do they reflect the key components of the Federal Sentencing Guidelines(which almost every employer needs to follow), they represent basic best practices when it comes to risk management, and fostering a culture of compliance.
The trend of Code adoption and ethics training is only continuing to build momentum. In the coming months and years, we're likely to see more of these types of regulations -- impacting employers of all sizes and types, and across all industries.
For more information about online training and awareness programs, go to ELT's ethics training resources.
ELT's industry expertise and unmatched legal content make its training solutions the absolute best in the marketplace.
Tammy McCutchen Former Administrator, Wage & Hour Division
Copyright © 2008-2010 
