New Fed Rules Require Contractors to Adopt Codes of Conduct and Implement Ongoing Ethics Training

Government Contractors Face Substantial Requirements

The new FAR rules are noteworthy for requiring both an employee awareness program and a robust internal audit program. Specifically, the regulations provide that an employee training program should extend to all employees, and represent an "ongoing" effort to ensure that employees both know and understand their obligations under their employer's Code.

Likewise, the regulations require affected contractors to institute internal controls, including suggested "periodic reviews of company business practices, procedures, policies and internal controls." This make a robust ethics and code of conduct program an absolute essential for employers doing even modest business with the federal government.

The new FAR requirements will sound very familiar to those in the private sector. Most organizations adopted Codes of Conduct and ancillary ethics training programs following the passage of the Sarbanes-Oxley Act in 2002, and amendments to the Federal Sentencing Guidelines in 2004. The FAR rules emphasize the need for an ongoing program, as well as the requirement to reach out to all employees. These requirements codify what we view as best practices for all organizations – whether doing business with the government or not.

The complete text of the new FAR requirements can be found at http://acquisition.gov/far/current/html/Subpart%203_10.html and http://acquisition.gov/far/current/html/52_200_206.html.

 

On the Horizon: Additional Training & Compliance Regulations Now Under Consideration

In addition to the recently released FAR amendments, Proposed Rules now under consideration specifically define elements of the mandated compliance programs, and require contractors to disclose suspected criminal conduct in connection with government contracts. They supplement the December 2007 regulations, and provide contractors with more detailed guidance on how to meet their training and compliance obligations.

• With respect to Code of Conduct training, the Proposed Rules seek to bring the FAR requirements into closer alignment with the requirements of the Federal Sentencing Guidelines and provide that contractors must take reasonable steps to periodically provide Code of Conduct training to all principals and employees, agents and subcontractors. They further provide that the training must be appropriate to each individual's duties.
  
  
• With respect to Internal Control Systems, the Proposed Rules identify additional, mandatory elements of an effective program.

The Proposed Rules also create a new "self-reporting" obligation for contractors. Specifically, the Proposed Rules would require contractors to disclose in writing to the government whenever they have reasonable grounds to believe that a principal, employee, agent or subcontractor has violated the False Claims Act or other provisions of federal law relating to the award or performance of a government contract.

These requirements are in line with widely recognized compliance training best practices. They likewise make clear that organizations must do more than give lip service to satisfy the new training requirements -- and that "check the box" Code training programs will simply not be enough.

These requirements were first laid out in a Proposed Rule published on November 14, 2007. The comment period ended January 14, 2008. The provisions of the Proposed Rule were modified slightly to include express references to detecting and reporting violations of the False Claims Act. These modifications were published on May 16, 2008. The comment period for them ends on July 15, 2008.

If adopted, the additional rules will likely become effective in late 2008 or early 2009.

A summary of the key elements in the final December FAR amendments as well as the Proposed Rules follows:

 

The New Amendments to FAR

Which Government Contractors Are Affected?

The new FAR requirements generally apply to any government contract worth at least $5,000,000 and which requires at least 120 days to perform, regardless of which government contracting agency is involved in the contract. The amendments also apply with minor exceptions to subcontractors providing services under the affected contracts.

 

How Does the Timing Work?

Within 30 days* of entering into a government contract, contractors must:

• Adopt a written code of business ethics and conduct;
• Provide a copy of the Code to each employee engaged in the performance of the government contract; and
• Promote compliance with the adopted Code.

*This time may be extended by the contacting officer and the requirement does not apply to existing contracts that were awarded before December 24, 2007, or to task orders awarded under those contracts.

Within 90 days of entering into a government contract, contractors must:

• Establish an "ongoing business ethics and business conduct awareness program; and
• Establish an internal control program aimed at:
  • The timely discovery of improper conduct; and
  • Ensuring corrective measures are taken.

 

What Kind of Employee Training and Audit Programs Are Required?

In general, the regulations provide that government contractors must adopt (1) employee business ethics and compliance training, and (2) internal audit programs:

• That are suitable to the size of the company and extent of its involvement in Government contracting.
• That facilitate the timely discovery and disclosure of improper conduct in connection with Government contracts
• That ensure corrective measures are taken.

For details on available online training and awareness programs, go to ELT's ethics training resources.

 

Do We Also Need to Display Hotline Posters?

Probably not.

Under FAR 52.203-14, if a contractor has implemented a business ethics and conduct awareness program, including a reporting mechanism (such as a hotline), then the contractor does not need to display any agency fraud hotline posters, other than any required DHS posters.

If a contractor has not implemented a business ethics and conduct awareness program, it must display a government agency or Department of Homeland Security-approved fraud hotline poster (available from the official Contracting Officer). This requirement will most likely apply to small businesses that are not required to follow the training and internal control rules. (See exceptions below.)

 

What Happens if We Don't Comply?

Contractors that fail to comply with these new requirements could face withheld payments, loss of fee award, or even debarment, suspension or other disciplinary action.

 

Are There Any Exceptions to the New FAR Requirements?

Yes.

The regulations do not apply when the contracts are awarded under the FAR Part 12 commercial item contracts clause, or when the contract will be performed outside of the United States, the District of Columbia, and outlying areas.

In terms of a partial exception, contractors that have represented themselves as small business concerns during the contracting process are excluded from the formal training program and internal control requirements.

These exceptions also flow through to subcontractors.

 

The Proposed Rules

What Do the Proposed Rules Cover?
The Proposed Rules provide greater detail regarding contractor compliance obligations and supplement, rather than replace, the recently passed amendments to FAR. Proposed requirements with respect to Code of Conduct training are expressly intended to align Code training requirements under FAR with similar requirements imposed under the Federal Sentencing Guidelines.

The Proposed Rules also require contractors to affirmatively report when they have reasonable grounds to believe there has been a criminal violation in connection with the award or performance of a government contract.

 

How Do Ethical Violations Impact Contractors under the Proposed Rules?

The Proposed Rules provide that ethical violations will be considered in the past performance evaluations of bidding companies. They also provide that contractors can be suspended and/or debarred for a "knowing failure" to timely disclose:

• An overpayment on a government contract; or
• A violation of the False Claims Act or other provision of federal law in connection with the award or performance of any government contract or subcontract.

 

What Are the Proposed Rules' Additional Training Requirements?

The Proposed Rules further confirm the breadth and scope of the required training. They prescribe a wide-ranging, comprehensive training program and dispel any notion that half-hearted training efforts are sufficient to meet the proposed standards.

Specifically, the Proposed Rules provide that:

• Affected organizations must include reasonable steps to "periodically" communicate their standards and procedures and other aspects of their business ethics awareness and compliance program and internal control system.
  The Proposed Rules do not specifically define how often training must be provided. However, case law in the context of harassment training and widely accepted training practices under the Federal Sentencing Guidelines strongly suggest that training must be provided every 12 to 24 months.
• The training must be "effective" in disseminating information appropriate to each individual's "roles and responsibilities."
  
• The training must be provided to all principals and employees and, as appropriate, the contractors agents and subcontractors. This confirms that contractors may not skirt their training obligations by limiting training to those employees specifically tasked with performance of the government contract.

 

What Are the Proposed Rules' Additional Guidelines Regarding Internal Control Systems?

The Proposed Rules also provide much greater detail regarding what Internal Control Systems should include how they should aid in the discovery of improper conduct, and the kinds of corrective measures that should be taken.

Among other things, the Proposed Rules provide that Internal Control Systems should include standards and procedures to facilitate the timely discovery of improper conduct and ensure that corrective measures are promptly instituted and carried out.

They also provide that Internal Control Systems should provide for the following:

• Assignment responsibility at a sufficiently high level in the organization to insure adequate resources are provided for both the training and internal control system.
  
• Reasonable efforts to ensure that a contractor's leaders including officers ,directors, owners and others with primary management responsibility have not engaged in illegal conduct or conduct which violates the contractor's Code of Conduct.
  
• Periodic reviews of company practices, procedures, policies and internal compliance controls, including:
  • Monitoring and auditing activities to detect criminal conduct.
  • Periodic reviews of the effectiveness of the company's training and internal control programs.
  • Periodic assessments of risk with appropriate steps to design, implement or modify the compliance training program and internal control system to reduce the identified risk.
• A confidential / anonymous internal "hotline" or other reporting mechanism.
• Disciplinary action for improper conduct or for failing to take reasonable steps to prevent or detect improper conduct.

Do the Proposed Rules Requires Companies to Voluntarily Disclose Potential Violations of Federal Law?

Yes.

The Proposed Rules provide that affected companies must "timely report" in writing to the agency Office of the Inspector General whenever they have reasonable grounds to believe that there has been a violation of the False Claims Act or other provisions of federal law relating to the award or performance of a government contract.

Whose Misconduct Must Be Reported Under the Proposed Rules?

The self-disclosure requirements are very broad under the Proposed Rules. The Rules provide that affected companies must disclose whenever they have reasonable grounds to believe there has been a violation of the False Claims Act or other federal law relating to the award or performance of a federal contract.

It is anticipated that these additional requirements will be approved. Stay tuned to ELT's website and blog for more updates.

What Should We Do Now?

If your organization does business with the federal government, you need to immediately determine whether you have current or prospective contracts valued over $5,000,000.

If you meet the threshold, it's imperative to create a robust and easy-to-understand Code. If you already have a Code, you should consider reviewing and updating it. The new regulations require "periodic reviews of company business practices, procedures, policies and internal controls." A Code should be a living document that reflects the ongoing needs and challenges of your business, as well as changes in the law.

The Code then needs to be widely distributed to your employees. The distribution requirement dovetails nicely with the requirement to establish "ongoing business ethics and business conduct awareness program." The most effective way to communicate the Code, and to bring it to life, is to include it as part of your enterprise-wide training program. With online education, the Code can be seamlessly delivered and tracked, along with the training.

Finally, you need to establish an "internal control program." Don't let this sound more complicated than it needs to be. The intent of the new FAR requirements is for companies to be able to discover improper conduct, and to take corrective action when they do. In short, you need to have an effective complaint and investigation procedure. This is likely something already well established at your organization.

The key is for employees to know about your complaint and investigation procedure – in other words, make sure that it's well publicized through your training programs and other forms of internal communications (intranet, periodic e-mail announcements etc.)

The other critical component is to have appropriate resources on hand to review complaints / reports, and to execute the appropriate follow up, which may include formal investigation and corrective action. These resources should also be monitoring: (1) the ongoing effectiveness of your training program (completion rates and employee awareness are key), and (2) the ongoing effectiveness of the complaint and investigation procedure (complaint processing times and resolution are key). Of course information gleaned from this periodic monitoring should inform the ongoing development of both your training program, as well as your internal control program.

Now here's a reality check for those of you hoping to fit the exceptions. Even if you're not technically covered by the new FAR requirements, it is still highly advisable to follow these new rules. Not only do they reflect the key components of the Federal Sentencing Guidelines (which almost every employer needs to follow), they represent basic best practices when it comes to risk management, and fostering a culture of compliance.

The trend of Code adoption and ethics training is only continuing to build momentum. In the coming months and years, we're likely to see more of these types of regulations -- impacting employers of all sizes and types, and across all industries.

For more information about online training and awareness programs, go to ELT's ethics training resources.