NEW REGULATIONS REQUIRE GOVERNMENT CONTRACTORS TO
INVESTIGATE AND SELF-REPORT CRIMINAL VIOLATIONS
Allison V. Feierabend1
Jennifer A. Short2
As of December 12, 2008, government contractors and subcontractors are subject to sweeping
new regulations that require, among other things, self-reporting of any violations of federal
criminal laws involving fraud, conflict of interest, bribery or gratuity. 3 The disclosure
obligations also extend to violations of the civil False Claims Act as well as "significant
overpayments," and are triggered by a contractor’s discovery of "credible evidence" – a term not
yet defined in the regulations but already the subject of debate. A "knowing" failure to make a
"timely" disclosure to government officials can result in the government contractor’s death
penalty: suspension or debarment from federal programs.
Separate from the mandatory disclosure requirements, the new rule sets forth contract clauses
that, when incorporated into a procurement contract, require most contractors and their
subcontractors to implement and maintain a full-blown compliance program. Failure to fulfill
these contract terms can result in contract termination.
The final regulations were announced on November 12, 2008, and are made part of the Federal
Acquisition Regulation (FAR), which governs contracts for the procurement of goods and
services by Executive Branch agencies, including the Department of Defense, the General
Services Administration, and the National Aeronautics and Space Administration.4 The new rule
builds upon previous FAR provisions addressing compliance, but is much more expansive in its
requirements, and much more limited in its exceptions. Therefore, all companies doing business
directly or indirectly with the federal government must be prepared to follow the new rule (even
if their current contracts make no mention of compliance or disclosure).
New Obligations Are An Outgrowth Of Compliance Program Focus And Requirements
The December 2008 final rule builds upon earlier compliance program requirements established
in a December 2007 amendment to the FAR. That rule – which is still in effect – required
1
Ms. Feierabend is an attorney in the Government Contracts practice group at Holland & Knight LLP. Her practice
includes compliance programs, counseling clients on diverse government contracts issues, bid protests, contractor
claims, and contract disputes.
2
Ms. Short is an attorney in the Litigation, White Collar, and Corporate Compliance groups at Holland & Knight
LLP. She serves as a co-chair on the Mid-Atlantic Region and Corporate Crime subcommittees of the ABA
Criminal Justice Section’s White Collar Crime Committee.
3
73 Fed. Reg. 67064, FAR Case 2007-006, Contractor Business Ethics Compliance Program and Disclosure
Requirements (Nov. 12, 2008).
4
The FAR is supplemented by individual agency regulations such as the Defense Federal Acquisition Regulation
Supplement (DFARS), but remains the baseline and default source for government contractor rules, contract terms,
and clauses. Individual agencies will likely promulgate any agency-specific supplements to the new rule in the near
future.
1
contractors and subcontractors receiving awards of contracts expected to exceed $5 million
(including options)5 and with a performance period of 120 days or more to:




Have a code of business ethics and conduct within 30 days of award;
Implement a training program on the code within 90 days of award;
Develop internal controls to support the code, also within 90 days of award; and
Display a hotline poster.
The December 2007 Final rule did not impose particular requirements for the training programs
or internal control systems that were mandated.6 Consequently, the Department of Justice
advocated amending the rule based on the elements of an "effective" compliance and ethics
program described in the United States Sentencing Guidelines for Corporate Defendants.7 The
elements recommended by the Department of Justice have been included in the new rule.8 Selfdisclosures are also a required part of the internal control system.9
Disclosure Must Be Made In Timely Fashion, Following Preliminary Internal Investigation
The new rule requires all contractors and subcontractors to disclose violations of Federal
criminal law involving fraud, conflict of interest, bribery or gratuities, or violations of the civil
False Claims Act in connection with a government contract or subcontract.10 The discovery of
"credible evidence" of a violation triggers the need to disclose.11 Although the key term
"credible evidence" is not defined, it presumably indicates that some form of internal
investigation has occurred that verifies or substantiates in some form mere allegations. Indeed,
the FAR Councils that authored the rule have explained that the term "credible evidence" implies
that a contractor will undertake a "preliminary examination of the evidence to determine its
credibility before deciding to disclose to the Government."12
The disclosure must be "timely,"13 and it must be made in writing to the Office of the Inspector
General (OIG) for the agency whose contract is affected by the violation.14 The agency's
5
The FAR Councils have also clarified that the $5 million trigger includes the anticipated dollar value of the
contract, including options. 73 Fed. Reg. 67085.
6
The December 2007 Final Rule also excepted certain contracts from its compliance program requirements,
including commercial item contracts and contracts that will be performed entirely outside the U.S. These exceptions
have been eliminated by the rule announced in November 2008, which will have widespread implications for
contractors working in Iraq and Afghanistan, among others.
7
See United States Sentencing Commission, Guidelines Manual, § 8B2.1. Notably, the Sentencing Guidelines
merely describe, and do not mandate, that any corporation, contractor, or organizational defendant implement a
compliance program. The new FAR rule makes clear that government contractors do not have the option of
adopting compliance measures; contractors are required to police themselves and to investigate and disclose
instances of wrongdoing.
8
48 C.F.R. 52.203-13(c)(1).
9
48 C.F.R. 52.203-13(b)(3).
10
Id.
11
73 Fed. Reg. 67074.
12
73 Fed. Reg. 67073.
13
Although there is no set time period for what constitutes "timely" reporting, timeliness is generally measured from
the date of determination of credible evidence. See 73 Fed. Reg. 67074. This raises timeliness issues for contractors
or subcontractors who knew of credible evidence of violations before the effective date of the rule.
2
contracting officer for the affected contract – who is typically a contractor’s primary point of
contact – receives a copy of the disclosure. 15
Contractors Are Expected To Provide "Full Cooperation"
Under the new rule, contractors and subcontractors must "fully cooperate" with the government's
efforts to audit, investigate, or take corrective action relating to reported violations.16 According
to a newly added definition, "full cooperation" means "disclosure to the Government of
information sufficient for law enforcement to identify the nature and extent of the offense and
the individuals responsible for the conduct. It includes providing timely and complete response
to Government auditors' and investigators' requests for documents and access to employees with
information."17
Consistent with recent Department of Justice guidance,18 full cooperation does not require
contractors to disclose information covered by the attorney client-matter privilege or work
product doctrine, nor does it call for any officer, director, owner, or employee to waive his or her
Fifth Amendment rights.19 The FAR Councils have stated that contractors may conduct an
internal investigation and defend proceedings or disputes relating to potential or disclosed
violations and still be deemed to have "fully cooperated."20
The Potential Penalty For Failing To Disclose Is High
The new regulations specify that the government may suspend or debar a contractor or
subcontractor for failing to disclose a violation or significant overpayment21 "known" by a
company's "principal."22 Contractors must disclose actual knowledge of credible evidence of the
violation.23 "Until the contractor has determined the evidence to be credible, there can be no
'knowing failure to timely disclose.'"24 However, the definition of "principal" easily could
include compliance officers or directors of internal audits, as well as other positions where initial
responsibility for investigating complaints and allegations may lie.25
14
The rule also specifies other reporting obligations if the violation relates to more than one contract or a multiagency contract. See 48 C.F.R. 52.203-13(c)(2)(ii)(F). For example, on Federal Supply Schedule contracts,
disclosures are to be made to the OIG for the ordering agency and the OIG of the agency responsible for the basic
contract.
15
48 C.F.R. 52-203-13(c)(2)(ii)(F) (which, pursuant to 48 C.F.R. 3.1003, applies regardless of whether the clause is
included in the contract).
16
The FAR Councils have indicated that the "cooperation" requirement does not apply to routine contract
administration matters. 73 Fed. Reg. 67078.
17
48 C.F.R. 52.203-13(a).
18
Principles of Federal Prosecution of Business Organizations (revised August 2008), available at
http://www.usdoj.gov/opa/documents/corp-charging-guidelines.pdf.
19
48 C.F.R. 52.203-13(a)(2).
20
48 C.F.R. 52.203-13(a)(3).
21
Overpayments resulting from contract financing payments (as defined in FAR 32.001) are not included.
22
"Principal means an officer, director, owner, partner, or a person having primary management or supervisory
responsibilities within a business entity (e.g. general manager; plant manager; head of a subsidiary, division, or
business segment and similar positions)." 73 Fed. Reg. at 67091.
23
73 Fed. Reg. 67079 (The FAR Councils indicate that "principals are only required to disclose what they know.")
24
73 Fed. Reg. 67074.
25
See 73 Fed. Reg. 67079.
3
In addition, the new rule allows for suspension or debarment due to a failure to report
"significant overpayments," which the rule does not define. The FAR Councils have indicated
that "significance" may not be measured by monetary value alone (contractors are already
obligated to report and return overpayments under the payments clauses of their contracts).26
Rather, what constitutes a "significant overpayment" is left to the judgment of the suspension
and debarment official.27
Suspension and debarment can be a fatal blow to a company's reputation and to its bottom line –
contractors who work primarily or even substantially in the federal sector can be put out of
business if they cannot compete for federal contracts for even a short period of time. The
government posts the name of individuals and companies that have been suspended, debarred, or
proposed for debarment on the Government's Excluded Parties List System (EPLS), which is
available on the GSA website. The government will not contract with anyone listed on the
EPLS, which typically lasts for up to three years. This includes a prohibition on new contracts as
well as entering contract modifications or exercising options to extend the performance of a
contract. Contractors must certify that they are not suspended or debarred when submitting
proposals for new work. The government also requires contractors to check the EPLS to ensure
that subcontractors are not on the list. The bottom line is that anyone on the EPLS can expect to
stop receiving government funded work. This new rule now permits the government to suspend
or debar contractors for failing to make required disclosures.
Mandatory Disclosure Requirements Apply To New, Existing, And Completed Contracts
The mandatory disclosure requirements of the new rule apply to all existing and future contracts
and subcontracts, regardless of whether the contract contains a specific clause addressing
disclosure, regardless of the contract value or duration, and regardless of the size of the
contractor.28 In effect, the disclosure regulations function as implied contract terms.
Moreover, disclosure obligations continue even on completed contracts – up to three years after
final payment is received.29 Although the government does not necessarily expect a company to
launch a full-blown investigation on every contract for which it received final payment in the last
three years, contractors who know of credible evidence of violations must examine their
disclosure obligations under these new rules.
The FAR Councils rejected comments that it is improper to apply the disclosure obligations
retroactively. They noted that criminal violations and violations of the civil False Claims Act are
already illegal and that the only change is the requirement to disclose the illegal behavior.30
In fact, in the weeks leading up to the December 12 effective date, it was clear that the Inspectors
General intend to immediately implement the mandatory disclosure requirements. Many
26
See e.g., 48 C.F.R. 52.232-25, 52.232-26, 52.232-27, and 52.212-4(i)(5).
73 Fed. Reg. 67080.
28
73 Fed. Reg. 67085.
29
See 48 Fed. Reg. 9.406-2(b)(1)(vi) (cause for debarment) and 9.407-2(a)(8) (cause for suspension).
30
73 Fed. Reg. 67073-67074.
27
4
agencies already have disclosure forms available on their websites.31 Although these forms
provide guidance for making disclosure, use of the form is not required.
It remains unclear how aggressive the Inspectors General will be in interpreting the mandatory
disclosure requirements. For instance, will a contractor be expected to examine its prior internal
investigations to consider whether "credible evidence" of a violation exists, even if it previously
determined that the evidence was insufficient to establish an actual violation? Is it sufficient for
a compliance officer or other high-level (but not executive or board level) manager to determine
what allegations and evidence require investigation and disclosure? What constitutes
"knowledge" of "credible evidence" and who within the contractor's organization might be
deemed to be a "principal" with the requisite knowledge?
While these issues are being considered and sorted out, contractors would be wise to position
themselves to comply with all of the requirements of the new rule, including the expanded
requirements for compliance programs. Even those contractors who currently have a compliance
and ethics program in place, should examine whether their programs meet the new requirements,
and, if not, where they fall short. The grace periods established by the FAR — 30 days after
contract award to implement codes of ethics and business conduct, and 90 days to implement
training and internal control systems — are generally not a sufficient amount of time in which to
do a risk assessment or gap analysis and then establish a program that meets any deficiencies.
To ensure that new internal policies and reporting mechanisms are rolled out in a timely and
coherent fashion, contractors are wise to plan now on how they will address all of the
requirements of the new rule.
31
See e.g., the GSA form, available at http://oig.gsa.gov/integritycover.htm.
5