# Federal Acquisition Regulation; FAR Case 2007-006, Contractor Business Ethics Compliance Program and Disclosure Requirements > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3AE8-26953 ## Record - **Collection:** Federal Register - **Document type:** Rule - **Published:** November 12, 2008 - **Citation:** 73 FR 67064 ## Text DEPARTMENT OF DEFENSE GENERAL SERVICES ADMINISTRATION NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 48 CFR Parts 2, 3, 9, 42 and 52 [FAC 2005-28; FAR Case 2007-006; Item I; Docket 2007-001; Sequence 11] RIN 9000-AK80 Federal Acquisition Regulation; FAR Case 2007-006, Contractor Business Ethics Compliance Program and Disclosure Requirements AGENCIES: Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA). ACTION: Final rule. SUMMARY: The Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (Councils) have agreed on a final rule amending the Federal Acquisition Regulation (FAR) to amplify the requirements for a contractor code of business ethics and conduct, an internal control system, and disclosure to the Government of certain violations of criminal law, violations of the civil False Claims Act, or significant overpayments. This final rule implements Pub. L. 110-252, Title VI, Chapter 1. DATES: Effective Date: December 12, 2008. Applicability: The Contractor's Internal Control System shall be established within 90 days after contract award, unless the Contracting Officer establishes a longer time period ( See FAR 52.203-13(c)). The Internal Control System is not required for small businesses or for commercial item contracts. FOR FURTHER INFORMATION CONTACT: Mr. Ernest Woodson, Procurement Analyst, at (202) 501-3775 for clarification of content. For information pertaining to status or publication schedules, contact the FAR Secretariat at (202) 501-4755. Please cite FAC 2005-28, FAR case 2007-006. SUPPLEMENTARY INFORMATION: Table of Contents A. Background B. Discussion and Analysis 1. Interrelationship of previous final rule, first proposed rule, second proposed rule, and new statute. 2. Mandatory standards for internal control system. 3. Mandatory disclosure to the OIG. 4. Full Cooperation. 5. Suspension/Debarment. 6. Extend to violation of civil False Claims Act. 7. Application to acquisition of commercial items. 8. Application to contracts to be performed outside the United States. 9. Other applicability issues. 10. Additional recommendations. 11. Regulatory Flexibility Act concerns. 12. Paperwork Reduction Act (PRA). 13. E.O. 12866. C. Regulatory Flexibility Act D. Paperwork Reduction Act A. Background This case is in response to a request to the Office of Federal Procurement Policy from the Department of Justice, dated May 23, 2007, and the Close the Contractor Fraud Loophole Act, Public Law 110-252, Title VI, Chapter 1. This final rule amends the Federal Acquisition Regulation to require Government contractors to— • Establish and maintain specific internal controls to detect and prevent improper conduct in connection with the award or performance of any Government contract or subcontract; and • Timely disclose to the agency Office of the Inspector General, with a copy to the contracting officer, whenever, in connection with the award, performance, or closeout of a Government contract performed by the contractor or a subcontract awarded thereunder, the contractor has credible evidence of a violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code; or a violation of the civil False Claims Act (31 U.S.C. 3729-3733). • The rule also provides as cause for suspension or debarment, knowing failure by a principal, until 3 years after final payment on any Government contract awarded to the contractor, to timely disclose to the Government, in connection with the award, performance, or closeout of the contract or a subcontract thereunder, credible evidence of— A. Violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code; B. Violation of the civil False Claims Act; or C. Significant overpayment(s) on the contract, other than overpayments resulting from contract financing payments as defined in FAR 32.001, Definitions. DoD, GSA, and NASA published a proposed rule in the Federal Register at 72 FR 64019, November 14, 2007, entitled “Contractor Compliance Program and Integrity Reporting.” The public comment period closed on January 14, 2008. (This was a follow-on case to the final rule under FAC 2005-22, FAR case 2006-007 that was published in the Federal Register at 72 FR 65868, November 23, 2007, effective December 24, 2007.) A second proposed rule was published in the Federal Register at 73 FR 28407, May 16, 2008, entitled “Contractor Compliance Program and Integrity Reporting.” The public comment period on the second proposed rule closed on July 15, 2008. On June 30, 2008, the Close the Contractor Fraud Loophole Act (Pub. L. 110-252, Title VI, Chapter 1) was enacted as part of the Supplemental Appropriations Act, 2008. This Act requires revision to the FAR within 180 days of enactment, pursuant to 2007-006, “or any follow-on FAR case to include provisions that require timely notification by Federal contractors of violations of Federal criminal law or overpayments in connection with the award or performance of covered contracts or subcontracts, including those performed outside the United States and those for commercial items.” The statute also defines a covered contract to mean “any contract in an amount greater than $5,000,000 and more than 120 days in duration.” First proposed rule. The first proposed rule, published in the Federal Register on November 14, 2007, proposed the following: 1. New causes for suspension/debarment. A contractor may be suspended and/or debarred for knowing failure to timely disclose— • An overpayment on a Government contract; or • A violation of Federal criminal law in connection with the award or performance of any Government contract or subcontract. 2. Changes to the requirement for a code of business ethics and conduct (52.203-XX). • Amplify the requirement to promote compliance with the code of business ethics. • Require timely disclosure to the agency Office of the Inspector General (OIG), with a copy to the contracting officer, whenever the contractor has reasonable grounds to suspect a violation of criminal law in connection with the award or performance of the contract or any subcontract thereunder. 3. Mandatory requirements for internal control system based on U.S. Sentencing Guidelines (USSG). • Provide more detail with regard to the ongoing business ethics awareness and compliance program (see 52.203-XX paragraph(c)(1)). • Make all the stated elements of the internal control system mandatory, rather than examples (see 52.203-XX (c)(2)(ii)). A. Add a new paragraph requiring assignment of responsibility within the organization for the ethics awareness and compliance program and internal control system. B. Require reasonable efforts not to include as principals individuals who have engaged in illegal conduct or conduct otherwise in conflict with the contractor's code of business ethics and conduct. C. Provide additional detail with regard to the requirement for periodic reviews. D. Require that the internal reporting mechanism or hotline must allow for anonymity or confidentiality. E. Provide that disciplinary action will be taken not only for improper conduct, but also for failing to take reasonable steps to prevent or detect improper conduct. F. Require timely disclosure, in writing, to the agency OIG, with a copy to the contracting officer, whenever the contractor has reasonable grounds to believe that a violation of Federal criminal law has been committed in connection with the award or performance of any Government contract performed by the contractor or the award or performance of a subcontract thereunder. G. Require full cooperation with any Government agencies responsible for audit, investigation, or corrective actions. Second proposed rule. The second proposed rule, published in the Federal Register on May 16, 2008, proposed the following: 1. Require inclusion of the clause at FAR 52.203-13 in contracts and subcontracts that will be performed outside the United States. 2. Require inclusion of the clause at FAR 52.203-13 in contracts (and subcontracts) for all acquisitions of a commercial item. However, similar to small businesses, a formal business ethics awareness and compliance program and internal control system are not required in contracts and subcontracts for the acquisition of commercial items. 3. Add a new cause for suspension and/or debarment, i.e. , knowing failure to timely disclose the violation of the civil False Claims Act (civil FCA) in connection with the award or performance of any Government contract or subcontract. The first two of these three proposed changes are now required by statute (Pub. L. 110-252, Title VI, Chapter 1). (As pointed out by one of the respondents, there was an error in the amendatory language in the Federal Register . At FAR 3.1004, the introductory text should have been deleted, rather than showing 5 asterisks, indicating that the introductory text is still present. However, the preamble made our intent very clear and this will be clarified in the final rule). Rule on Contract Debts. DoD, GSA, and NASA published a proposed rule, FAR case 2005-018, in the Federal Register at 71 FR 62230, October 24, 2006, regarding contract debts. The final rule was published in the Federal Register at 73 FR 53997, September 17, 2008, as part of Federal Acquisition Circular 2005-27. The intent of this rule is to evaluate existing controls and procedures for ensuring that contract debts are identified and recovered in a timely manner, properly accounted for in each agency's books and records, and properly coordinated with the appropriate Government officials. One of the following payment clauses should be included in each Government solicitation and contract: —52.212-4, Contract Terms and Conditions—Commercial Items, basic clause and Alternate I. —52.232-25, Prompt Payment. —52.232-26, Prompt Payment for Fixed-Price Architect-Engineer Contracts. —52.232-27, Prompt Payment for Construction Contracts. These Payment clauses for years have contained the requirement to immediately notify the contracting officer if the contractor becomes aware of any overpayment on a contract financing or invoice payment. Compliance with this requirement fulfills the statutory requirement of Pub. L. 110-252 for timely notification of overpayments. In addition, under the Contract Debts rule, these Payment clauses were modified to require that if the contractor becomes aware of a duplicate contract financing or invoice payment or if the contractor becomes aware that the Government has otherwise overpaid on a contract financing or invoice payment, the contractor shall— • Remit the overpayment amount to the payment office cited in the contract along with a description of the overpayment; and • Provide a copy of the remittance and supporting documentation to the contracting officer. Because issues of overpayment were addressed in FAR case 2005-018, the Councils did not include additional coverage on contract debt in the subject FAR Case, except for adding— • Knowing failure to timely disclose significant overpayment as a cause for debarment/suspension as stated at Subpart 9.4 Debarment, Suspension, and Ineligibility; and • A cross reference at 3.1003(a)(3) to this new cause of suspension/debarment at Subpart 9.4. B. Discussion and Analysis The FAR Secretariat received 43 responses to the first proposed rule. The FAR Secretariat received comments on the second proposed rule from 25 respondents of which 15 respondents had also submitted comments on the first proposed rule and 10 respondents were submitting comments for the first time. Overall, 18 of the 53 respondents were from Government agencies, including many responses from agency Offices of the Inspector General (OIG). In the second proposed rule the Councils specifically requested comments on three issues: • Elimination of the exemption from inclusion of the clause FAR 52.203-13 for contracts and subcontracts that will be performed entirely outside the United States. • Elimination of the exemption from inclusion of the clause FAR 52.203-13 for contracts (and subcontracts) for all acquisitions of a commercial item under FAR Part 12. • Requirement for mandatory disclosure of violations of the civil FCA (31 U.S.C. 3729-3733) (in the clause, in the internal control system required by the clause, and as a cause for suspension or debarment). Comments on the second proposed rule that do not relate to these three issues, unless presenting a new and pertinent perspective, have not been separately addressed in this preamble. 1. Interrelationship of Previous Final Rule, First Proposed Rule, Second Proposed Rule, and New Statute a. Previous Final Rule, FAR Case 2006-007 The first proposed rule under FAR case 2007-006 (“first proposed rule”), proposed increases to the requirements introduced by final rule, FAR case 2006-007 (“previous final rule”), in the ways enumerated in the Background section above. Thirteen respondents remarked on the relationship to the previous final rule, some suggesting changes to the previous final rule as well as the first proposed rule. i. Like the previous final rule under 2006-007. • No further change needed. One respondent expressed the belief that the previous final rule is adequate to protect the Government's interest. Several other respondents supported the previous final rule's voluntary disclosure. One respondent questioned the need for the first proposed rule in light of the recent implementation of “more expansive contractor compliance standards in the FAR.” • The first and second proposed rules enhance the previous rule. One Government agency explicitly supported the major provisions of both rules as sound business practices, highlighting their contribution to cost control as well as mission safety. Response: No response necessary. ii. Ethics code. With regard to the requirement for a code of conduct, one respondent considered that just having a code is meaningless. Several other respondents also objected to the requirement for a code of business ethics and conduct in the previous final rule under FAR case 2006-007, stating that existing contractor ethics standards work well and that these contractual requirements are redundant, add costs and other burdens, and are likely to generate additional uncertainties. Several respondents objected to the outdated method of communicating the code, requiring a copy to each employee engaged in the contract. One respondent recommended that it may be more effective to refer employees to Web sites or provide tutorials in person, on-line, or through other means. This suggestion could minimize burdens through the use of information technology, as requested in the preamble to the proposed rule for this case. Another respondent also objected that many institutions have more than a single code of conduct, each addressing different aspects of conduct that together cover all aspects of conduct that the FAR rule requires. Response: The Councils do not agree that a code of conduct is meaningless. It can serve several related purposes. For a firm's business partners, including the Government, it provides a basis for evaluating the firm's responsibility, including special standards of responsibility when appropriate. It also provides a basis for internal policy development, for example human resources policies. And when something goes wrong, the code is meaningful for enforcement and for understanding and perhaps incorporating lessons learned. While requiring establishment of a code will add costs and require effort on the part of entities that do not have them already, the Councils agree with several respondents that those resources are reasonable and justified to mitigate other and larger risks to the success and efficiency of Government projects. Because many entities already have made the investment, the rule will level the playing field in competitive environments. The Councils agree that flexibility in the method of communicating the code to employees is appropriate, and the rule has been changed to require that it be made available to each employee engaged in performance of the contract. The Councils note that the rule does not preclude having multiple codes of conduct applicable to different segments of contractors' business lines. iii. Training. • Training requirement is too burdensome. One respondent was concerned that the requirements for training could take substantial time away from performing on their contracts to train staff on an unknown scope of Federal criminal law. The Government would incur costs from this activity through delays in the fulfillment of contracts and increased contractor expenses that will be passed along to customers. Response: The Councils recognize that contract costs are reflected in prices, but do not consider schedules to be impacted by this requirement. By identifying the scope of violations of the Federal criminal law as those involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code, the Councils believe that the training requirements have been more clearly defined and the contractor's training requirement has been reduced. • Require training on civil FCA. Several respondents proposed that Government contractors be required to educate their employees about the protections available under the civil FCA. The Department of Justice, Criminal Division (DoJ) suggested that contractors should also be required to include in their “business ethics awareness” obligation, reflected in the proposed rule at FAR 52.203-13(c)(2)(ii)(F), training on the civil FCA. Response: The Councils do not agree that it is necessary under this case to dictate to contractors what they need to cover in business ethics training. If we highlight education on the civil FCA, or other specific areas, the contractors may place undue emphasis only on those areas mentioned in the regulations. The business ethics training courses may cover appropriate education on the civil FCA, as well as many other areas such as conflict of interest and procurement integrity and other areas determined to be appropriate by the contractor, considering the relevant risks and controls. iv. Hotline posters. One respondent commented that the physical display of multiple hotline posters in common work areas is impractical and wasteful. Another respondent also objects to using hotline posters on the walls of the institution as being the most effective way of communication at every institution. Response: The issue of multiple hotline posters was resolved under the final rule 2006-007. The requirement for hotline posters is outside the scope of this case. b. Relationship of Second Proposed Rule to First Proposed Rule One respondent questioned whether certain requirements of the first proposed rule that did not appear in the second proposed rule had been deleted. Response: The preamble of the second proposed rule specified that it included only the sections of the rule affected by the three changes; it was only addressing three issues, not providing a completely revised proposed rule. Therefore, the fact that language in the first proposed rule that would not be affected by the 3 issues of concern was not repeated in the second proposed rule does not imply that that language was being deleted. c. Relationship of Second Proposed Rule to New Statute One respondent recommends that any disclosure requirement be limited to violations of the types specified in the “Closing the Contractor Fraud Loophole Act (Pub. L. 110-252, Title VI, Chapter 1)” ( i.e. , exclude violations of the civil FCA). This respondent also states that the statute does not require the disclosure to the OIG and the penalties of debarment/suspension are not required by the new statute, so should be eliminated. Another respondent also makes the point that since the new law does not address disclosure of violations of the civil FCA, that requirement should not be included in the final rule under this case. One respondent notes particularly that the new law does not require the “reasonable grounds to believe” standard, reporting to the Inspector General, or failure to report as an independent basis for suspension or debarment. Response: This rule was initiated as a matter of policy. Although the new statute reinforces and provides a statutory basis for some aspects of the rule, the fact that any part of the rule is not required by statute does not alter the rationale that provided the underpinning for those aspects of the rule. Each aspect of the rule not required by statute must be considered on its own merits. 2. Mandatory Standards for Internal Control System a. Minimum Requirements for the Internal Control System One respondent considered that the previously recommended, now mandatory, internal control practices will be inadequate if they are considered to be maximum as well as minimum requirements. Another respondent considered the establishment of an internal control system that satisfies a laundry list of mandates will be overly burdensome. Another respondent would prefer that contractors be left free to choose to implement the USSG “in the prudent exercise of their business discretion,” rather than being required to do so. Likewise, another respondent stated that contractors may want to consider the USSG in designing compliance programs but, absent a statute or Executive order, they should not be made mandatory in the regulations. Response: The rule does reflect minimum expectations. Competing firms are free to establish the highest ethical standards they consider to be appropriate to the business at hand. This case establishes a framework for institutional ethics management and disclosure and does not prescribe specific ethical requirements. b. Relation of Rule to the USSG i. Rule is consistent with the USSG. An agency OIG stated that the proposed rule should benefit Federal contractors. It provides guidance for contractors consistent with U.S. Sentencing Commission guidance on effective compliance and ethics programs for organizations. Compliance with the rule should assist contractors subject to the Sarbanes-Oxley Act of 2002 in fulfilling their responsibilities under the Act. Response: None needed. ii. USSG should be incorporated by reference. Several respondents commented that rather than using the ad hoc form of the USSG standards for compliance and ethics program, the actual USSG standards should simply be incorporated by reference. Conformity with the USSG will prevent contractors unknowingly failing to comply with all the USSG although complying with the FAR. Formal adoption of the USSG will create uniform criteria. A respondent recommended that all the descriptive paragraphs in (ii) be deleted, instead inserting: “The Contractor's internal control system shall provide for a compliance and ethics program that meets the standards of the Federal Organizational Sentencing Guidelines, as amended from time to time, United States Sentencing Commission Guidelines Manual: Sentencing of Organizations, section 8B2.1. Response: These respondents would use the USSG Guidelines, in place of the FAR spelling out the required elements of internal control systems. However, the Councils prefer to spell out the elements. This lets the contractors know what is expected. The USSG are the source of the FAR text, but the FAR text is intentionally not adopting them verbatim. The procurement regulations are not the USSG; the contractor setting up an internal control system is in a different situation than a company accused of a crime. Some elements of the USSG are not appropriate for a procurement regulation. However, by making the minimum requirements generally consistent with the USSG, the Councils believe that a contractor should be in a better position if accused of a crime. iii. Essential parts of the USSG are missing. One respondent commented that essential parts of the USSG are missing. One example is the reference to the use of an incentive system in compliance programs that encourages and rewards companies for implementing effective programs, following the model of the Organizational Sentencing Guidelines. The respondent recommends modifying 52.203-13(c)(1)(ii)(E) by inserting after “detect improper conduct” the words “and appropriate incentives to perform in accordance with the compliance and ethics program”. Another example the respondent uses is the standard for effectively responding to violations, and taking steps to prevent recurrence. Without these, a company's program would not be considered effective under the USSG. Response: The Councils note that the respondent must have intended to cite FAR 52.203-13(c)(2)(ii)(E). The Councils do not want to require incentives for employees within contractors' internal control systems. This is within companies' discretion. The mitigating factors for debarment (9.406-1(a)) already include consideration of remedial action ( e.g. , (6), (7), and (8)) taken by the contractor. The FAR does cover responding to violations, and preventing recurrence, in FAR 52.203-13(c)(2)(i), and throughout (c)(2)(ii). c. Principals Several respondents asked for interpretation of the clause paragraph (c)(2)(ii)(B) requirement that the internal control system provide for reasonable efforts not to include within the organization principals whom due diligence would have exposed as having engaged in conduct that is illegal or otherwise in conflict with the Contractor's code of business ethics and conduct.” • Is the “organization” the entire contractor, instead of the organization responsible for the code? • Is the code retroactive to catch criminal behavior in the past? • Is it only Federal crimes, or state and local as well? • What about non-criminal behavior that did not violate the Contractor's code at the time? • What kind of due diligence is necessary—a simple pre-employment questionnaire, or instead a costly background check with interviews of friends and neighbors? Response: • The Councils have revised the draft final rule (paragraphs (c)(2)(ii)(A), (B), and (C) of the clause 52.203-13) to eliminate use of the term “organization”. This term was a carryover from the USSG. This rule is addressed to the contractor—the entity that signed the contract, and subcontractors thereunder. • The code of conduct is not itself retroactive. However, it is necessary to distinguish conduct of an employee during his/her employment, from past conduct uncovered during a background check of a prospective hire. That past conduct need not be disclosed to the Government, but should be part of the decision whether to hire the individual. • Past criminal behavior of any type, even criminal behavior unrelated to contracting, calls into question whether the individual at the present time has integrity and is a proper role model for company staff. This is not a mandate to fire the individual, but to determine whether the individual is currently trustworthy to serve as a principal of the company. • Behavior that was not criminal and did not violate a business's code as it existed at the time, is not the subject of this rule. In response to this comment, the Councils have revised paragraph (c)(2)(ii)(B) to delete the words “illegal or otherwise.” The term “illegal” is too broad and could include even a traffic violation. The Contractor's code of business ethics and conduct should cover the types of behavior that this requirement is intended to address. • The level of background check required depends on the circumstances. This is a business decision, requiring judgment by the contractor. The source of the FAR clause paragraph (c)(2)(ii)(B) is the USSG Manual paragraph 8B2.1.(b)(3). The Commentary on this paragraph includes this statement: “With respect to the hiring or promotion of principals, an organization shall consider the relatedness of the individual's illegal activities and other misconduct ( i.e. , other conduct inconsistent with an effective compliance and ethics program) to the specific responsibilities the individual is anticipated to be assigned and other factors such as: (i) the recency of the individual's illegal activities and other misconduct; and (ii) whether the individual has engaged in other such illegal activities and other such misconduct.” d. Periodic Review One respondent asked for an interpretation of the clause paragraph (c)(2)(ii)(C) requirement for periodic review of business practices. For “monitoring and auditing”, is standard business practice and generally acceptable accounting principals sufficient? What system for assessing the “risk of criminal conduct” would be sufficient? Is there a Government program that is an acceptable process? Response: Standard business practice for “monitoring and auditing to detect criminal conduct” which conforms to generally accepted accounting principles should be sufficient. The “monitoring and auditing” is amplification of the current FAR requirement for periodic review and auditing, from the FAR case 2006-007 published in November 2007. One respondent stated that annual audits of research processes may already review compliance with policies for ethical conduct of research funded under Federal contracts. The FAR can acknowledge, through an Alternate to the clause, that duplication of review is not required where reviews under other rules already cover the necessary subjects. Response: The FAR is not requiring wasted duplication of effort. No change to the regulation is necessary. 3. Mandatory Disclosure to the OIG Of the 43 respondents that commented on the first proposed rule, 36 commented specifically on sub-paragraph (b)(3) of the clause 52.203-13, Contractor Code of Business Ethics and Conduct, which requires mandatory disclosure, in writing, to the agency OIG, with a copy to the contracting officer, whenever the contractor has reasonable grounds to believe that a principal, employee, agent, or subcontractor of the contractor has committed a violation of Federal criminal law in connection with the award or performance of the contract or any subcontract thereunder. Six agency OIGs, as well as several Government agencies all specifically concurred with the mandatory disclosure of violations by contractors. Other respondents, including agency OIGs, while concurring with mandatory disclosure, suggested improvements in the way this requirement is implemented in the rule. The other 17 respondents that commented specifically on the mandatory disclosure disagreed with this approach and recommended voluntary disclosure. a. Need for Mandatory Disclosure Note that the following comments in this section all preceded the enactment of the statute that requires mandatory disclosure, so that the issues are now primarily moot. i. Major departure from long-standing policy. One respondent stated that this rule is a major departure from long-standing and proven Federal policies that encourage voluntary disclosures. Likewise, another respondent stated that mandatory disclosure runs counter to many established Government processes. One respondent considered the proposed regulation to be a “sea change” in the fundamental approach to compliance followed by the Government. Another respondent noted that in 1986 a proposal from DoD to make fraud disclosures mandatory foundered on “state action” grounds. In 1988, then Secretary of Defense Richard Cheney withdrew a proposed rule that would have governed such programs on the grounds that “to be meaningful, corporate codes of conduct must be adopted by contractors voluntarily, not mandated in procurement regulations (54 FR 30911)”. Another respondent also cited a 1996 GAO report on the DoD Voluntary Disclosure Program (GAO/NSIAD-96-21) in which the GAO quotes the DoJ as praising the DoD Voluntary Disclosure Program. Several respondents cited the DFARS regulations as being a model for voluntary disclosure. Several other respondents stated that many Federal agencies that have considered mandatory disclosure rules have declined to adopt them in favor of voluntary disclosure programs ( e.g. , Department of Health and Human Services in 2000 (65 FR 40170) and in 2004 (69 FR 46866)). Response: There is no doubt that mandatory disclosure is a “sea change” and “major departure” from voluntary disclosure, but DoJ and the OIGs point out that the policy of voluntary disclosure has been largely ignored by contractors for the past 10 years. In addition, in that same time period mandatory disclosure has been adopted for banks and public companies and stressed by the U.S. Sentencing Commission and DoJ, as further discussed in the following sections. ii. Is voluntary disclosure working? Various respondents stated that the proposed rule fails to demonstrate that there is a need for change based on failure of voluntary disclosure. According to these respondents, neither DoJ nor the Councils have cited data supporting the claim that voluntary disclosure is not effective. One respondent stated that a purported paucity of participants in the DoD IG Voluntary Disclosure Program does not establish a decline in contractor disclosures to the Government sufficient to justify a mandatory disclosure requirement. Another respondent stated that DoJ is comparing the last few years to data from 20 years ago. One respondent cited disclosures for FY 2005-2007 that are relatively level. Another respondent cited the December 2006 issue of Corporate Counsel that voluntary disclosures are increasing rather than decreasing, citing Mr. Mark Mendelssohn of DoJ and a recent report by Sherman & Sterling. Even if there is a decline in disclosure under the DoD Voluntary Disclosure Program, another respondent found that the leap to mandatory disclosure “gives rise to a perverse implication that justification for mandating regulations can be asserted simply because no one has shown that the activity to be regulated is not happening.” One respondent stated that the assumptions about the reason for the decrease are misplaced. Another respondent firmly believed that there is need for analysis of the reasons for any decline in voluntary disclosures. Even if mandatory disclosures to the DoD IG Voluntary Disclosure Program are decreasing, several respondents suggested the following possible explanations: • Less emphasis by DoD. • Fewer reportable violations. • More instances resolved as contract matters, with reports to contracting officers or heads of contracting activities or to audit agencies like DCAA and DCMA. • Perception that the Government is slow in processing voluntary disclosures. • Lack of restrictions on use of disclosure reports in criminal or civil actions or in administrative actions against individuals. One respondent elaborated that there may be fewer voluntary disclosures because self-governance is working to prevent and detect contract formation and contract performance issues before they result in criminality or civil fraud. Reduction in the rate of voluntary disclosures would be an expected byproduct of improved internal processes, enhanced training, better internal controls, and an improved culture of ethics and compliance. One respondent stated that a number of companies have commented that delays in processing disclosures to the OIG are a significant factor in their decision to report problems to the contracting officer instead of to the DoD Voluntary Disclosure Program. One respondent suggested other avenues for disclosure that are more relevant to the kinds of illegal activity being found these days, such as— • The DoJ Antitrust Division. Voluntary disclosures to DoJ have increased as disclosures to the DoD IG program have decreased ( see http://www/usdoj.gov/atr/public/speeches/232716.htm#N_1_) ; • The Department of State Directorate of Defense Trade Controls. This program has been very successful at inducing voluntary disclosures ( see GAO-05-234 (Feb 2005)); and • Foreign Corrupt Practices Act. Enforcement actions for violations of the FCPA have also grown, again largely due to voluntary disclosures made by corporations ( see “U.S. Targets Bribery Overseas Globalization; Reforms Give Rise to Spike in Prosecutions,” The Washington Post (Dec 5, 2007)). One respondent suggested that mandatory reporting should be replaced with a strong voluntary disclosure program modeled after the DoJ Antitrust Division's Corporate Leniency Programs. Another respondent noted that it is DoJ, not DoD, that apparently believed that the mandatory disclosure provisions were necessary. This respondent interpreted this to mean that DoD is satisfied with the number and types of disclosures being made. One respondent stated that DoJ should be required to demonstrate that there is an upward trend of criminal prosecutions of the top 100 Government contractors where it was established that contractor principals were aware of violations of the law and made a conscious decision not to disclose those violations to the Government. Similarly, another respondent suggested that DoJ should offer factual support for its thesis that crimes are occurring and being found and yet not being reported voluntarily. One respondent also wanted DoJ to explain why other less burdensome changes, such as improving the existing voluntary disclosure programs, cannot be used to achieve the desired result. On the other hand, in the DoJ letter of May 23, 2007, DoJ stated that its experience suggests that few corporations have actually responded to the invitation of DoD that they report or voluntarily disclose suspected instances of fraud. An agency OIG stated that the vast majority of crimes involving contractors that it investigates are not reported by the contractor. Another agency OIG stated that Government contractors are coming forward significantly less frequently with voluntary disclosures. It considered that this mandatory requirement may be the most effective way for the Government to monitor its vendors. Response: In the DoJ letter dated May 23, 2007, which requested the Administrator of the Office of Federal Procurement Policy, Mr. Paul Denett, to open this case, DoJ states that its experience suggests that few companies have actually responded to the invitation of DoD to report or voluntarily disclose suspected instance of fraud. The respondents do not dispute that relatively few contractors are using the DoD Voluntary Disclosure Program. The contractor groups, in their public comments on the rule, implicitly concede that the Voluntary Disclosure program is not being used and blame DoJ and the OIG. Some claim that informal disclosures are being made to the contracting officers but offer no specific evidence. Even if it is true that there are comparatively fewer violations now than 20 years ago or that some situations are resolved administratively, there are still significant numbers of violations occurring and being prosecuted that have not been self-disclosed. Importantly, the incentive to self-disclose Antitrust violations is not applicable. Antitrust deals with the Sherman Act and the Clayton Act, which prohibit conspiracy in restraint of interstate or foreign trade and regulate practices that may be potentially detrimental to competition (price discrimination, exclusive dealing contracts, etc.). Under the Antitrust Division's Corporate Leniency Program, the first company that reports the violation receives immunity from prosecution. That type of circumstance does not apply here. iii. Existing legal requirements and regulations as models for the rule. In the DoJ letter of May 23, 2007, DoJ stated that— • Unlike healthcare providers or financial institutions, there is at present no general requirement that contractors alert the Government immediately as a matter of routine when fraud is discovered; • DoJ has been careful not to ask contractors to do anything that is not already expected of their counterparts in other industries; • Our Government's expectations of its contractors has not kept pace with the reforms in self-governance in industries such as banking, securities, and healthcare. Several respondents all considered that for far too long contractors have played by different rules than their counterparts in other industries, such as health care providers and research grant recipients. A Government agency commented that healthcare providers and banks have had such a requirement for many years. An agency OIG commented that in the past 15 years there have been significant reforms in industries such as banking, securities, and healthcare, yet we have not asked the same of Government contractors. In the DoJ letter of May 23, 2007, DoJ stated that the requested changes are modeled on existing requirements found in other areas of corporate compliance such as the Sarbanes-Oxley Act of 2002 and expand slightly on the Contractor Standards of Conduct in DFARS 203.7000. DoJ also noted that the National Reconnaissance Office (NRO) has begun requiring its contractors to disclose contract fraud and other illegal activities. a. More far-reaching. However, one respondent stated that the proposed rule imposes substantially more far-reaching and draconian disclosure obligations on Government contractors than those presently made applicable to financial institutions by submission of Suspicious Activity Reports (12 CFR 21.11). The financial institution has to report a crime if the financial institution is an actual or potential victim of the criminal activity. Where a contractor is a victim of a crime committed by an employee or another person, the employee's conduct is not imputed to the contractor. Therefore, the corporation does not incur the risk of criminal liability when it reports an employee violation and is not incriminating itself. According to another respondent, the current laws and regulations are not sweeping and burdensome, but are specific and narrowly focused. The respondent pointed out that the Anti-Kickback Act and Foreign Corrupt Practices Act limit their mandatory disclosure to a very limited class of activity. The respondent also pointed out that Sarbanes-Oxley contemplates internal reporting mechanisms and review mechanisms at the highest levels before any reporting occurs. The other respondent also addressed the internal control certification required by the Sarbanes-Oxley Act of 2002. Sarbanes-Oxley applies to a contractor that is a public company. Section 302 of Sarbanes-Oxley does not require that a public company disclose to the Government conduct it believes may be a violation of criminal law. Response: Many of the public comments reveal a basic misunderstanding of the existing mandatory disclosure requirements found in the healthcare, banking, and securities areas. Each requirement effectively mandates disclosure of fraud as broad as the particular regulatory issue being addressed can reach. Beyond that limitation, these other requirements are no more limited than the proposed rule, particularly with the further changes in the final rule with regard to the types of Federal crimes covered. In particular, the Councils do not agree with the interpretation of 12 CFR 21.11. 12 CFR 21.11 requires financial institutions to report suspicious activities committed or attempted against the bank or involving a transaction or transactions conducted through the bank, where the bank was used to facilitate a criminal transaction. Even though Section 302 of Sarbanes-Oxley does not require a public company to disclose to the Government conduct it believes may be a violation of criminal law, there are pre-existing securities laws and regulations that require disclosure to the SEC. Sarbanes-Oxley does not provide immunity from prosecution for wrong-doing but provides protection against third-party liability with regard to a lawsuit by the persons accused of wrongdoing. b. Conforming the FAR? One respondent stated that if the FAR Council is relying on conforming the FAR to regulations applicable to other industries as a justification, the Council should state this explicitly and provide a detailed analysis of the regulations in other areas on which it is relying. Response: The Councils did not rely on conforming the FAR to regulations applicable to other industries as a justification, but merely cited some parallels. The FAR regulations are designed to suit the particular circumstances of acquisition. c. Particular public need/statutory basis? One respondent stated that current disclosure programs are not instructive. The respondent also stated that these programs are targeted towards a particular public need, and in most cases are the product of legislation that was enacted in response to a particular public scandal or important national need. In enacting statutory schemes, Congress saw a particular need and targeted legislation to address the particular need (Sarbanes-Oxley, the Anti-Kickback Act, the Foreign Corrupt Practices Act, and banking laws). Several respondents were concerned that the same justification does not exist for this proposed rule as the cited statutes and regulations. One respondent stated that the Council has not provided a rational basis to explain why such a significant change to the FAR is necessary. The respondent asserted that the proposed rule could be challenged under the Administrative Procedure Act (APA) because the FAR Council has not provided a “rational basis” to justify the mandatory disclosure requirement, nor is there statutory authority behind the FAR Council to issue a regulation providing for mandatory disclosure of criminal acts. The respondent therefore concluded that the FAR Council lacks the authority to issue the regulation ( See AFL/CIO v. Kahn, 472 F. Supp. 99 (D.D.C. 1979), rev'd, 618 F. 2d 784 (D.C.Cir. 1979)). One respondent saw this as particularly important in light of DoJ's reliance upon the example of other statutorily-mandated disclosure programs (Sarbanes-Oxley, Foreign Corrupt Practices Act, etc.) as justification for this regulatory initiative. The respondent stated that the mandatory disclosure provisions in the proposed rule are neither the product of specific findings or legislation, nor any perceived critical national need, and thus are not appropriately compared to other existing mandatory disclosure programs. Response: The DoJ proposed a mandatory disclosure program in order to emphasize the critical importance of integrity in contracting. The public demands honesty and integrity in corporations with which the Government does business. If there is concern that there is not a current public need warranting proceeding with this case, the Councils cite the public outcry over the overseas exemption in the first proposed rule and the recent enactment of the Close the Contractor Fraud Loophole Act (Pub. L. 110-252, Title VI, Chapter 1). The Act requires exactly what the first rule proposed, except that the overseas and commercial item exemptions have been eliminated. However, the rule did not require this legislation in order to have the authority to proceed in this case. The Councils issue rules under the authority of the Office of Federal Procurement Policy Act as well as 40 U.S.C. 121(c), 10 U.S.C. chapter 137, and 42 U.S.C. 2473(c). The Administrator for Federal Procurement Policy may prescribe Governmentwide procurement policies to be implemented in the FAR (41 U.S.C. 405). This case was opened at the request of OFPP. This case is making clear what was already expected. It is not unreasonable or “capricious” to require contractors doing business with the Government to disclose violations of the civil False Claims Act (civil FCA) or a violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code that have occurred in connection with the award, performance, or closeout of any Government contract performed by the contractor or a subcontract thereunder. Existing DoJ guidelines addressing corporate prosecution standards, while certainly not providing amnesty, suggest that if a company discloses such violations, the prosecution will be of the individuals responsible for the violation, not the entire organization. d. Empirical support that mandatory disclosure will achieve the Councils' objective. One respondent stated that mandating disclosure without empirical support to show that it will achieve the Councils' objectives will be susceptible to challenge. The APA requires courts to strike down rules devoid of factual support. Another respondent also cited the APA, and that a rule may be set aside if it is arbitrary or capricious (5 U.S.C. 706). Response: The Councils point to the testimony from DoJ and various OIGs that the experience with the NRO mandatory disclosure clause has been positive (see next paragraph). The Councils further cite the enactment of the Close the Contractor Fraud Loophole Act (see prior section), which now mandates many of these revisions to the FAR. e. The NRO requirement. An agency OIG noted that similar contractually imposed disclosure requirements have been successfully implemented by the NRO. According to DoJ, the NRO reports that this requirement has improved its relationships with its contractors and enhanced its ability to prevent and detect procurement fraud. Another agency OIG stated that adoption of the NRO clause resulted in increased and earlier disclosure of wrongdoing and better working relationships built upon greater sharing of information and trust. It also led to the conclusion that it is more effective for a contractor to mandatorily disclose information pursuant to a requirement, than it is for a contractor to be in a position of offering up information that it could be criticized, or even sued, for providing. One respondent, however, stated that the NRO requirement is not an appropriate model for all Government contractors because it requires disclosure of potential illegal activity related to the conduct of intelligence operations in the interest of national security and thus is not instructive. In fact, according to another respondent, the unique nature of the NRO and its responsibilities are major reasons cited as justification for its disclosure program. Similarly, the other respondent stated that, while the NRO's mandatory disclosure program was not the product of legislation, it was the direct product of an obvious and public awareness that we live in a different world after September 11, 2001. Furthermore, several respondents cited problems with the NRO disclosure program. One respondent stated that “it is far from clear at this point whether the NRO mandatory disclosure program is or will be productive”, citing anecdotal reports from the contractor community suggesting that the program is not as effective as the NRO claims. One respondent cited problems experienced by contractors subject to the NRO OIG reporting clause, claiming that the NRO OIG has inserted itself in the administration of contracts by using the clause as the basis to become involved in all aspects of the contractor ethics functions and corporate investigations. For example, the respondent stated that the OIG has used this clause to investigate, as a Federal offense, matters as mundane as employees who have been disciplined for leaving work early while reporting they were present. The respondent does not believe that OIG agents should be routinely involved in company internal ethics functions and contract administration. The respondent quoted Mr. Paul Denett, Administrator of the Office of Federal Procurement Policy: “The IG serves a purpose, but it needs to be limited to core areas.” However, the response from the National Procurement Fraud Task Force (NPFTF), signed by the IG of the NRO, stated that the requirement for mandatory reporting has worked very well at NRO: The reporting of wrongdoing has increased, comes earlier, and has led to a good working relationship. NPFTF considers that this model can have a similar impact across the Federal Government, and that the situation at NRO is not unique. Response: Almost all the agency OIGs submitting public comments cite the success of the clause initiated by the NRO OIG as a reason for supporting this rule for their agency procurements. As to limiting the role of the OIG to its core area, the core area of the OIG is to investigate fraud, conflict of interest, bribery, and gratuity violations. OIG agents will not be routinely involved in company internal ethics functions and contract administration unless violations are disclosed. The final rule has been revised to more closely focus the situations that must be disclosed by limiting violations of criminal law to violations involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code (see B.3.b.iii.). iv. Will mandatory disclosure make reporting easier or better? In the DoJ letter of May 23, 2007, DoJ stated that if the FAR were more explicit in requiring such notification, it would serve to emphasize the critical importance of integrity in contracting. An agency OIG stated that the requirement will simplify the contractors' decision on whether to disclose suspected violations. Likewise, another agency OIG stated that the contractor is in a stronger position when reporting for the purpose of complying with a mandatory requirement than if voluntarily disclosing information, for which it could be criticized, or even sued. Another agency OIG commented that making self-reporting a requirement gives the honest contractor employees necessary leverage over those who may seek to shield the employer when wrongdoing is noticed or suspected. On the other hand, some other respondents believed that if employees know that everything they report will be passed on to the Government, this may result in less reporting up the chain of the company rather than more. One respondent saw substantial potential to decrease rather than enhance cooperation with company compliance efforts. The respondent was concerned that the likelihood of severe consequences will necessarily change the relationship of the company and its employees. Every interview will have the potential of resulting in employees being reported. It may be that investigative targets may not only be entitled to counsel, but to Miranda warnings, if the company is deemed to be acting on behalf of the Government. Further, another respondent was concerned that mandatory reporting may violate existing contracts with a labor union and may be an unfair labor practice if imposed without bargaining, citing American Elec. Power Co., 302 NLRB 161(1991). Resistance by the employees can undercut the entire compliance program. A respondent also believed that employees may be reluctant to come forward if they are aware that the contractor will be required to report their co-workers, or report the company itself, to the OIG. This respondent cited studies by the framers of the USSG who undertook significant research addressing these issues. Response: The Councils believe that by mandating disclosure, contractor executives and their counsel will be more inclined to make the required disclosure to the OIG, as opposed to either not disclosing or informally alerting the contracting officer, who is not in a position to evaluate the criminal behavior of individual employees. By mandating disclosure to the OIG, the rule will add weight to the arguments inside a corporation that good business practices in the long run favor compliance and disclosure. Nothing in the proposed rule requires administration of “Miranda” warnings. The rule does not place contractors in the role of law enforcement officers. With regard to the concerns about labor agreements, contractors can find ways to disclose without violating labor union provisions that protect individual privacy of workers. v. Cooperative atmosphere more effective. According to one respondent, voluntary disclosure fosters a cooperative environment and rewards contractors that adopt effective internal controls. Another respondent considered that it is a key principle to promote self-governance as the preferred model to ensure compliance. This respondent quoted the Packard Commission findings in June 1986 that self-governance is the most promising mechanism to foster improved contract compliance. Self-governance makes the difference between responsibility for compliance and a mere facade of compliance. This respondent concluded that, based on 20 years of experience, both scholars and industry leaders believe that the current system of voluntary disclosure encourages companies to develop a stronger culture while still affording the Government broad remedies to protect the Government's interests. Under mandatory disclosure, contractors may focus on the ambiguities of the letter of the rule rather than the spirit of mutual commitment. One respondent expressed long standing support for and experience with voluntary self-reporting. It is concerned that mandatory self-reporting could discourage partnerships with the Government. One respondent cited the “fundamental principle” that contractor compliance programs resulting from internal company commitments to ethical behavior are more likely to be effective in preventing illegal behavior than programs imposed by “overbearing regulations.” Response: The Councils disagree. See “Is voluntary disclosure working?” at paragraph B.3.a.ii. vi. Incentives. Several respondents contended that existing Government programs and contractor initiatives offer ample incentives for contractors to voluntarily report procurement violations. • Several respondents pointed out that contractors may receive favorable consideration in debarment proceedings if they have voluntarily disclosed the conduct in question. • Several respondents cited the civil FCA, which provides contractors with an incentive to report potentially fraudulent behavior. Organizations will voluntarily disclose to avoid lengthy and costly whistleblower litigation ( qui tam actions). According to several respondents, voluntary disclosure can undermine a court's jurisdiction to entertain future qui tam cases and can mean the difference between maximum and reduced penalties. • Several respondents also addressed the reduced penalties under the guidelines of the USSG, adopted in 1991, which are predicated on a model of rewarding voluntary reports. Two respondents stated that the proposed rule is inconsistent with the favorable treatment of voluntary disclosures under the USSG. • Respondents cited the Deputy Attorney General's January 20, 2003, memorandum, “Principles of Federal Prosecution of Business Organizations,” which provides to Federal prosecutors guidance governing charging decisions with respect to corporations and sentencing. Several respondents also cited Deputy Attorney General Paul J. McNulty's memorandum of December 12, 2006, which demonstrated that the DoJ considers an organization's voluntary disclosure and cooperation in determining whether to bring charges. Various respondents were concerned that the proposed rule may eliminate the ability of a contractor to claim the benefit of “timely and voluntary disclosure” to the Government. One respondent recommended that, if the rule is finalized, a contractor should not be precluded from seeking and receiving leniency because a disclosure is made in compliance with the rule. One respondent stated that the proposed rule is not more consistent with the USSG, but actually contradicts them. One respondent stated that the Councils must consider these concerns and evaluate the extent to which eliminating incentives to voluntary disclosure will affect a contractor's decision to disclose underlying behavior. The respondent believed that eliminating incentives could cause contractors to adopt a protective posture in the face of evidence of potential criminal behavior. Another respondent suggested that, instead of mandating compliance and ethics programs, the Councils should open a new FAR case to develop an incentive-based approach. This respondent was concerned that the logic of penalizing contractors for failure to disclose a crime, rather than offering incentives, will not work. The disclosure obligation applies only if a crime has already occurred. If there is already a crime, then the company is already subject to punishment. Failure to disclose will only be an aggravating factor. So, if a company fails to disclose, it may escape punishment, but if it discloses, it will likely still be subject to punishment for the crime committed. Therefore, punishment for failure to disclose may not be sufficient incentive to disclose. Response: There is nothing in this rule that removes any of the existing incentives. The incentives in the FAR (FAR 9.406-1(a)) and the USSG are not limited to “voluntary” disclosures but to “disclosures.” Even if disclosure is “mandatory,” incentives will still be offered to promote compliance. b. Vagueness of Rule i. “Reasonable grounds to believe.” Numerous respondents were concerned that the rule does not specify what constitutes “reasonable grounds.” One respondent stated that “reasonable grounds” is subject to varying interpretations, and may be viewed as an even lower standard than “probable cause.” Should the contractor report based on mere suspicion or based on evidence that criminal activity has occurred? Because of this lack of clarity, several respondents were concerned that companies may tie up Government resources with a mountain of meaningless legal trivia. Numerous respondents stated that there will be substantial over-reporting because contractors may report even remotely possible criminal conduct out of an abundance of caution. One respondent considered that this will raise company costs through the investigation of baseless claims and incidents. Several other respondents stated that there will be an enormous amount of time spent sorting out the true criminal activity and truly significant problems. One respondent suggested that the proposed rule will potentially subject an employer to civil actions brought by an employee when the reports forwarded by the employer to the Federal Government (because conceivably “reasonable grounds” existed) ultimately are determined to lack merit. Response: The Councils have replaced “reasonable grounds to believe” with “credible evidence.” DoJ Criminal Division recommended use of this standard after discussions with industry representatives. This term indicates a higher standard, implying that the contractor will have the opportunity to take some time for preliminary examination of the evidence to determine its credibility before deciding to disclose to the Government. See also the following discussion of “timely disclosure.” ii. Timely disclosure. There are 3 aspects of timely disclosure that are of concern to the respondents: • To which violations/contracts does timely disclosure apply? • How much time does a contractor have to disclose a possible violation after first hearing something about it? • How do we transition into this rule? How is timeliness measured for violations that the contractor may already know about and did not disclose prior to becoming subject to this rule? Further, in analyzing these issues, there are 3 separate requirements for timely disclosure in this rule which may affect the response to the above questions: • The contract clause requirement to disclose (paragraph (b)(3)). • The contract clause requirement for an internal control system (paragraph (c)(2)(ii)(F)). • Failure to timely disclose as a cause for suspension/debarment regardless of requirement for contract clause or internal control system (Subpart 9.4). a. To which violations/contracts does timely disclosure apply? Various respondents were concerned about whether the rule can apply to violations that occurred before the effective date of the rule, the date of the bid, or the date the clause is incorporated into the contract. • Effective date of the rule. Numerous respondents recommended that the rule be made applicable only to conduct occurring on or after the date the rule is effective. The respondents argued that there is presently no requirement in the FAR for a contractor to disclose to the Government criminal violations committed by its employees. The respondents cited case law to support the argument that application of the rule to conduct occurring before the rule effective date would be impermissible. One respondent stated that the reporting requirement should be “prospective only”. Otherwise this requirement may impose an unreasonable burden. • Date the clause is incorporated. Another respondent questions whether the rule is meant to cover past acts, or only acts going forward from the date the clause is incorporated into a contract. According to one respondent, to punish entities for past acts would violate constitutional ex post facto prohibitions. • Date of the bid. One respondent suggested that the violation would have to occur after the date of the bid. Several respondents also looked at the end of the period during which violations that occur must be reported. One respondent suggested that completion of performance would be appropriate. DoJ suggested limiting the mandatory disclosure of overpayments or criminal violations to matters discovered by the contractor within three years after contract completion. Response: The first significant point to remember is that in all cases the reportable violations are linked to the performance of Government contracts. In the case of the contract clause direct requirement for contractor disclosure, the reportable violations are limited to the contract containing the clause. So the questions raised by the respondents about occurrence of violations are not an issue with regard to the contract clause disclosure requirement, because violations would necessarily occur during award or performance of the contract, through contract closeout, which would necessarily be after the effective date of the rule and after incorporation of the clause. ( Note: The clause will be included in solicitations and resultant contracts after the effective date of the rule, in accordance with FAR 1.108(d)). However, in the case of internal control systems and suspension/debarment, the proposed rule states that reportable violations could occur in connection with “any Government contract.” This could be overly broad in two regards— • Does it apply to violations on the contracts of other contractors? • Does it apply to contracts closed out 20 years ago? The Councils have made clear in the final rule that this disclosure requirement is limited to contracts awarded to the contractor (or subcontracts thereunder). It was not the intent of the proposed rule to require contractors to report on violations of other contractors under contracts unrelated to their own contracts. The Councils do not agree with the respondents who think that disclosure under the internal control system or as a potential cause for suspension/ debarment should only apply to conduct occurring after the date the rule is effective or the clause is included in the contract, or the internal control system is established. The laws against these violations were already in place before the rule became effective or any of these other occurrences. This rule is not establishing a new rule against theft or embezzlement and making it retroactive. The only thing that was not in place was the requirement to disclose the violation. If violations relating to an ongoing contract occurred prior to the effective date of the rule, then the contractor must disclose such violations, whether or not the clause is in the contract and whether or not an internal control system is in place, because of the cause for suspension and debarment in Subpart 9.4. However, the Councils agree that this requirement should not stretch back indefinitely into the past ( e.g. , contracts that were closed 20 years ago). At that point, relevance with regard to present responsibility has diminished, there is less availability of evidence to support an investigation, there is more difficulty locating the responsible parties (who is the contracting officer?), and there should be some reasonable limitation on a contractor's liability after contract closeout. The Councils considered using contract closeout as the end point for the requirement to disclose fraud, but according to the DoJ, often contract fraud occurs at the time of closeout, and cutting off the obligation to disclose at that point would exempt many of these violations from the obligation to disclose. Three years after final payment is consistent with most of the contractor record retention requirements ( see Audit and Records clauses at FAR 52.214-26 and 52.215-2). Therefore, the Councils concur with the DoJ recommendation that the mandatory disclosure of violations should be limited to a period of three years after contract completion, using final payment as the event to mark contract completion. Therefore, the Councils have added the phrase “Until 3 years after final payment on any Government contract awarded to the contractor” at 9.406-2(b)(1)(vi) and 9.407-2(a)(8), and has added in the clause at paragraph (c)(2)(ii)(F) the statement that “The disclosure requirement for an individual contract continues until at least 3 years after final payment on the contract.” To make the applicability during the close-out phase of a contract clearer, the Councils have revised the draft final rule in all applicable places to refer to “award, performance, or closeout.” b. Does “timely” allow sufficient time between first learning of the allegation and the disclosure? One respondent objected that “timely” is very broad in scope which could permit contracting officers to have inconsistent interpretations of what is timely. One respondent questioned whether “timely” means upon first learning of an allegation or only upon conducting an adequate internal investigation. The respondent recommended that the regulations should include a set period of time ( i.e. , 90 days) for any reporting requirement. Another respondent recommended that the regulations might allow 60 days to determine if there are reasonable grounds to conclude that the contractor committed a crime. The 60 day period would start when a principal of the company suspects that a crime might have been committed, but lacks reasonable grounds for concluding that a crime has been committed. An agency OIG suggested “timely” should be replaced with “within 30 calendar days.” Another respondent was concerned that when “timely” disclosure must occur is ambiguous because the timing of a violation is troublesome. Contractors often settle cases without any admission of fault or liability. The rise in deferred and non-prosecution agreements in criminal cases brought by the Government against contractors creates confusion regarding disclosure of criminal violations. According to many respondents, the proposed rule may require premature reporting. One respondent questioned the requirement to notify without delay, whenever the contractor becomes “aware” of violations of Federal criminal law. According to this respondent, the rule does not clarify what constitutes “awareness.” Several other respondents were concerned that the proposed amendment does not appear to allow a contractor to complete an internal investigation before notifying the OIG and contracting officer. Several respondents considered that an internal investigation could be compromised by premature reporting. One respondent recommended that the rule should allow the contractor the opportunity to comply with its ethics and compliance program and conduct an internal investigation prior to disclosure to the Government. Contractors should be required to report only actual violations of law, not those incidents that have not been confirmed as actual violations. One respondent pointed out that existing voluntary disclosure protocols allow for internal investigation by the reporting parties before a disclosure is made. Another respondent stated that under the DoD Voluntary Disclosure Program, if the preliminary investigation reveals evidence to suggest that disclosure is warranted, contractors may disclose information sufficient for preliminary acceptance into the DoD Voluntary Disclosure Program, and then have 60 days to complete a fuller investigation. This rule provides no guidance on preliminary steps afforded to a contractor. One respondent also recommended that the contractor be explicitly provided with a reasonable period of time to internally investigate a potential violation. DoJ suggested that the preamble to the final rule should make clear that nothing in the rule is intended to preclude a contractor from continuing to investigate after making its initial disclosure to the Government. DoJ would expect that the OIG or the contracting officer will encourage the contractor to complete its internal investigation and make full report of its findings. In their comment on the second proposed rule, one respondent recommends that the preamble should explain that a contractor, with the contracting officer's approval, may tailor the “timely reporting” provision of its internal control system in order to make meaningful reports to the contracting officer. Response: First, the Councils note that the new statute uses the term “timely” in setting forth disclosure requirements. The Councils considered, and rejected, adding a set period of time, e.g. , 30 days, to the disclosure requirement. It was decided that doing so would be arbitrary and would cause more problems than it would resolve, e.g. , how to determine when the 30 days begins. Further, the Councils believe that using the standard of “credible evidence” rather than “reasonable grounds to believe” will help clarify “timely” because it implies that the contractor will have the opportunity to take some time for preliminary examination of the evidence to determine its credibility before deciding to disclose to the Government. Until the contractor has determined the evidence to be credible, there can be no “knowing failure to timely disclose.” This does not impose upon the contractor an obligation to carry out a complex investigation, but only to take reasonable steps that the contractor considers sufficient to determine that the evidence is credible. The Councils note that there is no rigidness to our proposed requirement to establish an internal control system. The rule just sets forth minimum requirements. The contractor can use its own judgment in the details of setting up a system that meets the minimum requirements. The clause does not require contracting officer approval of this system. c. Transitioning into the rule. Meaning of “timely” when the knowledge of credible evidence pre-dates the requirements of this rule. One respondent stated that the reporting requirement should be “prospective only”. Otherwise this requirement may impose an unreasonable burden. Response: As just discussed, the disclosure requirement is prospective only. Although violations on the current contract might have occurred during the pre-award phase and violations on other contracts may have already occurred prior to establishment of the internal control system or prior to the effective date of the rule, timely disclosure of the violation can only be measured from the time when the requirement to disclose the violation came into effect, even if credible evidence of the violation was previously known to the contractor. With regard to the contractual disclosure requirement, the timely disclosure would be measured from the date of determination of credible evidence or the date of contract award, whichever event occurs later. With regard to the disclosure requirement of the internal control system, it can only become effective upon establishment of the internal control system. The violation can have occurred with regard to any Government contract which is still open or for which final payment was made within the last 3 years, so may predate establishment of the internal control system. Therefore, timely disclosure of credible evidence as required by the internal control system would be measured from the date of determination by the contractor that the evidence is credible, or the date of establishment of the internal control system, whichever event occurs later. With regard to the knowing failure by a principal to timely disclose credible evidence of a violation or significant overpayments as a cause for suspension or debarment, the violation can have occurred with regard to any Government contract, which is still open or for which final payment was made within the last 3 years, so may predate the effective date of the rule. Therefore, timely disclosure of credible evidence as required by the rule as a cause for suspension or debarment would be measured from the date of determination by the contractor that the evidence is credible, or from the effective date of the rule, whichever event occurs later. To some extent, the effective date of the rule actually trumps the other events, because the failure to timely disclose as a cause for suspension/debarment is independent of the inclusion of the contract clause in the contract or the establishment of an internal control system. At least in those instances where disclosure was not timely in regard to effective date of the rule, but was reported as soon as the clause was in the contract, or as soon as the control system was in place, then it would not be a violation of the contract or a mark against the control system. It could still be a cause for suspension or debarment, although the Councils consider that suspension or debarment would be unlikely, if the contractor came forward as soon as the clause or the internal control system was in place (before that, the contractor might have been unaware of the requirement to disclose). iii. “Criminal violation in connection with contract award or performance.” Numerous respondents stated that the rule fails to specify what constitutes a “criminal violation” “in connection with contract award or performance”. Some of these respondents made the following comments: • The broad nature of the phrase “violation of Federal criminal law in connection with contract award or performance” places a heavy burden. The Government is in the best position to provide specific guidance to contractors as to the violations that would be considered covered by this new requirement. Otherwise, each contractor will have to develop its own list and explanations to its employees as to what constitutes criminal violations. • If the FAR Council proceeds with the rule, it should provide a specific list of the criminal violations that the contractor is required to disclose. • The self-reporting requirements should be revised to provide the specific circumstances under which self-reporting is required. • The provision is vague in regard to the type of “criminal violation” covered, leaving open application of the rule to non-procurement related offenses. If an employee commits a criminal violation while driving on Federal lands in the course of performing a contract, must the traffic violation be reported to the agency OIG? Also, the agency OIGs may receive reports about violations of Federal tax law or Occupational Safety and Health laws that occur in connection with the performance of the contract, over which the OIGs do not have jurisdiction. This can result in unnecessary or inappropriate reports. • The proposed rule does not elaborate on the nexus between the perceived criminal conduct and the Federal contract so as to trigger the reporting requirement. A contractor's silence could be alleged to be a false statement where the employer had “reason to believe” that one of its employees, agents, or subcontractors had violated criminal law in connection with a contract. • The rule should define more clearly what is reportable and when the obligation to report is triggered. One Government agency suggested adding “potential” to “violation.” DoJ also suggested tightening the standard for disclosure by adding the phrase “involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code.” Response: The Councils have adopted the more specific description of criminal law suggested by DoJ as responsive to many of the concerns expressed by the respondents. As to nexus with the contract, the clause stipulates in paragraph 52.203-13(b)(3)(i) that the violation should have occurred “in connection with the award, performance, or closeout of this contract, or any subcontract thereunder.” With regard to the internal control system disclosure required in paragraph 52.203-13(c)(2)(ii)(F) and the cause for debarment or suspension in Subpart 9.4, the violation must be in connection with the award, performance, or closeout, of any Government contract performed by the contractor, or a subcontract thereunder, and the obligation to disclose information lasts until 3 years after final payment. If there is no connection to a Government contract performed by the contractor, or a subcontract thereunder, then it need not be disclosed. The Councils do not consider it necessary to add “potential” to “violation” because that preceding language already is in terms of “credible evidence.” That does not necessarily mean that a violation has occurred, but the principals are looking for “credible evidence” that a violation has occurred. “Potential violation” would open it even wider and could result in too many unnecessary disclosures. iv. Level of employee with knowledge. Several respondents wanted the rule to identify the level of contractor employee whose knowledge will be imputed to the contractor, such that the contractor has the requisite knowledge. Absent such identification, consistent with the doctrine of respondeat superior applied in Federal criminal law, a contractor may be deemed to have requisite knowledge warranting disclosure if any employee at any level is aware of conduct which may constitute a Federal criminal offense. This could cause a contractor to be accused of violating the mandatory disclosure provision before the contractor's management becomes aware of the offense and before the appropriate steps for disclosure may be undertaken. One respondent stated that it is unreasonable to expect all knowledge to be passed up the chain. Several respondents recommended revision of the proposed rule to require that a contractor principal must have the requisite knowledge of a Federal criminal law violation before that knowledge will be imputed to a contractor. Response: The Councils concur that for debarment and suspension, a principal must have the requisite knowledge in order for mandatory disclosure to be applicable. See response under the heading “Suspension/Debarment”, “Who has knowledge?” at paragraph B.5.e. c. Disclosure to OIG. One respondent considered that the proposed rule would essentially require contractors and subcontractors to become fraud detection and reporting entities. Must contractors become experts in forensic accounting and private investigation? This respondent considered that the proposed rule essentially would “deputize” contractors and subcontractors as agents of the OIG. One respondent also considered that the company is now acting as an agent of the Government. Is “the agency OIG” the OIG for the agency which awarded the contract under which the action in question took place? One respondent was concerned when contractor is required to disclose to different inspectors general because the proposed rule is silent on what actions and procedural safeguards are to be implemented in the various offices of the Inspectors General. A contractor that deals with a variety of different Federal agencies will unreasonably be faced with significantly increased risk and uncertainty. Several respondents considered that a likely outcome of the mandatory reporting to the agency OIG will be to remove from a contracting officer or agency the authority or the ability to settle and compromise the issues by a disclosure. One industry association indicated that member companies report that in their experience, the vast majority of potential violations disclosed to a contracting officer or other agency official are quickly resolved as an administrative matter. Once a matter is referred to the DoD OIG as a potential criminal or civil fraud matter, under the Contract Disputes Act the contracting officer loses his or her ability to compromise or settle the issue. One respondent was also concerned about the impact of the proposed rule on the influence and authority of the contracting officer. The respondent considered that disclosure to the OIG passes the leadership role on any subsequent investigation and review to the OIG's office and undercuts the authority and ability of the contracting officer to manage contracts. One respondent noted that under the DFARS rule, the OIG only needs to be notified when appropriate. One respondent considered that mandatory notification to the OIG defeats the concept of internal audits and correction of possible irregularities. The respondent is concerned that, once the OIG is brought into the process, both the contracting officer and the contractor/subcontractor lose control of the process. One respondent was concerned with the ability of the OIG to handle an increased level of reports. One respondent stated that their experience with the capability of the OIG's offices to deal with complicated, sophisticated and/or fact-intensive issues is very mixed at best. Current demands have placed substantial strain in the ability of the OIG's offices to support investigations, and delays are commonplace. “According to the respondent, ‘competing demands for resources to support overseas investigations and Homeland Security defense have drained whatever experienced resources existed” at the agency OIGs. An agency OIG suggested replacing “agency Office of the Inspector General” with “A President-selected and Senate-approved Inspector General or designated Federal entity Inspector General.” The agency OIG stated that this better describes the correct agency to which the contractor should report potential violations. Response: There is nothing in the proposed rule that “deputizes” contractors. The Councils have concluded that it is appropriate for contractors to send the reports directly to the OIG, with a copy to the contracting officer, because it is the OIG that is responsible for investigating the disclosure. The disclosure would be to the OIG of the agency that awarded the subject contract. The Councils have added clarification that if a violation relates to more than one Government contract, the Contractor may make the disclosure to the agency OIG and Contracting Officer responsible for the largest dollar value contract impacted by the violation. If the violation relates to an order against a Governmentwide acquisition contract, a multi-agency contract, a multiple-award schedule contract such as the Federal Supply Schedule, or any other procurement instrument intended for use by multiple agencies, the contractor shall notify the OIG of the ordering agency and the IG of the agency responsible for the basic contract. Whether OIGs can handle an increase in the level of reporting depends on the expected level of increase. The Councils do not anticipate that companies are going to flood the OIG with trivialities, as some respondents fear. The Council also notes that the agency OIGs were all strongly in favor of this rule. The Councils do not agree with the suggestion of one agency IG that the rule should specify “A President-selected and Senate-approved Inspector General or designated Federal entity Inspector General.” Although this is probably accurate, the Councils consider it too complicated for some contractors to determine. It is the opinion of the Councils that, if a contractor submits a report to the wrong OIG, that OIG will forward it to the appropriate OIG. Throughout the rule, the Councils have used the words “disclose” and “disclosure” for consistency, rather than in some places using the word “notify” or “report”. 4. Full Cooperation The proposed rule states at paragraph (c)(2)(ii)(G) of FAR 52.203-XX (now 52.203-13) that a contractor Code of Business Ethics and Conduct shall, at a minimum, have an internal control system that provides “full cooperation with any Government agencies responsible for audit, investigation, or corrective actions.” a. Waiver of Privileges/Protections/Rights Many respondents expressed concern that compliance with the rules requiring disclosure and full cooperation would be interpreted to— • Require contractors waive an otherwise valid claim of attorney-client privilege or protections afforded by the attorney work product doctrine, both protecting attorney-client communications; or • Interfere with an employee's right under the Fifth Amendment of the U.S. Constitution covering the right of an individual not to be compelled to incriminate itself. One respondent recommended addition of strong language to preserve privilege protections. DoJ and an agency OIG indicated awareness of these concerns in their comments and recommended clarification in the final rule. DoJ proposed that the final rule state explicitly: “Nothing in this rule is intended to require that a contractor waive its attorney-client privilege, or that any officer, director, owner, or employee of the contractor, including a sole proprietor, waive his or her attorney-client privilege or Fifth Amendment rights.” Response: It is doubtful any regulation or contract clause could legally compel a contractor or its employees to forfeit these rights. However, the Councils have revised the final rule to provide such assurance. To address concern that cooperation might be interpreted to require disclosure of materials covered by the work product doctrine, the Councils have added a definition of “full cooperation” at 52.203-13(a) to make clear that the rule does not mandate disclosure of materials covered by the attorney work product doctrine. For comparison purposes, it is instructive to refer to the flexible approach adopted in the USSG: Waiver of attorney-client privilege and of work product protections is not a prerequisite to a reduction * * * unless such waiver is necessary in order to provide timely and thorough disclosure of all pertinent information known to the organization. It also is worth pointing out the DoD Voluntary Disclosure Program never required waiver as a condition of participation. Contractors in that program routinely found ways to report wrongdoing without waiving the attorney-client privilege or providing their attorney memoranda reflecting their interviews that normally are covered by the work product doctrine. Any limitation in this rule should not be used as an excuse by a contractor to avoid disclosing facts required by this rule. Facts are never protected by the attorney-client privilege or work product doctrine. Moreover, the Fifth Amendment has no application to corporations, so the only sensitive area is mandatory disclosure or cooperation by individuals or sole proprietors, which is addressed in the clarification. b. Indemnification of Employees Several respondents expressed concern that full cooperation will be interpreted as prohibiting a contractor from indemnifying its employees or their individual counsel to the extent permitted or required by state law or the contractor's charter or bylaws. Several respondents expressed concern that the Government may view indemnification of contractor employees as not cooperating. One respondent asked if there was a difference between “cooperation” and “full cooperation” and, more seriously, whether full cooperation restricted a contractor's ability to make counsel available to its employees. Several respondents pointed to the district court opinion in U.S. v. Stein, 435 F.Supp. 2d 330 (SDNY 2006), and 440 F.Supp. 2d 315 (SDNY 2006) that suggests the Government viewed KPMG's practice of paying for employees' legal costs pursuant to indemnification rules was not “cooperation” favored by the prosecutors in that case. Response: With regard to indemnification of employees for legal costs, State law—not Federal—controls. Just as full cooperation cannot mean a company forfeits its attorney-client privilege, there is no reason to think it means employees forfeit their right to indemnification from their employers. On December 12, 2006, DOJ addressed this issue in a memorandum sent to all DoJ attorneys by Deputy Attorney General Paul McNulty (“McNulty Memorandum”), stating: Prosecutors generally should not take into account whether a corporation is advancing attorneys' fees to employees or agents under investigation and indictment. Many state indemnification statutes grant corporations the power to advance the legal fees of officers under investigation prior to a formal determination of guilt. As a consequence, many corporations enter into contractual obligations to advance attorneys' fees through provisions contained in their corporate charters, bylaws or employment agreements. Therefore, a corporation's compliance with governing state law and its contractual obligations cannot be considered a failure to cooperate. c. Requirement to Fire an Employee One respondent asked that the rule clarify that cooperation does not mean a contractor must fire an employee. Response: It is inappropriate for the Government to direct a contractor to fire an employee, although the Government may require that an employee be removed from performance of the Government contract. However, most corporate compliance programs assert that violation of law or company policy is grounds for dismissal. Also note the internal control system requirements for principals at paragraph (c)(2)(ii)(B) of the clause. d. Ability To Conduct a Thorough and Effective Internal Investigation Several respondents expressed concern that cooperation or disclosure will be interpreted to interfere with a contractor's ability to conduct a thorough and effective internal investigation. Some respondents were concerned that a contractor continuing to investigate a matter after reporting would be deemed not cooperating. One respondent recommended that the rule state explicitly that: “A contractor has a reasonable time to investigate a potential investigation * * * and that nothing in the rule prohibits or restricts a contractor from conducting an internal investigation.” Response: Any interpretation of full cooperation that would suggest a limit on contractors conducting internal investigations would be clearly at odds with the intent of the rule, which encourages compliance program investigations, reporting, and cooperation. e. Defending a Proceeding or Dispute Arising From or Related to Disclosure Various respondents expressed concern that full cooperation will be interpreted to preclude a contractor from defending itself in a proceeding or dispute arising from or related to the disclosure. One respondent raised concerns that a rule mandating full cooperation could be interpreted as prohibiting a contractor from “vigorously defending its actions.” Another respondent observed that full cooperation might require a contractor to waive its right to appeal the results of an audit. Response: Nothing in the rule would foreclose a contractor from advancing a defense or an “explanation” for the alleged fraud or corruption arising in a Government contract. This includes being free to use any administrative or legal rights available to resolve any dispute between the Government and the contractor. The rule is intended simply to require the contractor to be forthcoming with its customer, the Government, with regard to credible evidence relating to alleged fraud or corruption in its Government contracts. f. Expansion of Audit Rights and Access to Records Various respondents asked to what extent full cooperation overrode the limits on Government audit rights and access to records limitations, giving the Government “unfettered access” to individuals to conduct interviews, even though the current audit access clauses are limited to documents. Expanding on that, one respondent also asked if the rule requires contractors to give the Government “full access to their financial and proprietary information, beyond that required by existing contract clauses.” Another respondent also observed that the Government may invoke the requirement in connection with disputes before the Board of Contract Appeals or U.S. Court of Federal Claims. One respondent requested clarification that the cooperation requirement applies only to agencies affected by the conduct and not the entire Government. Response: The proposed rule was not intended to have any application or impact on the Government's exercise of its audit and access to records rights in the routine contract administration context except as the issue arises when a contractor discloses fraud or corruption or the Government independently has evidence sufficient to open an investigation of fraud and solicit the contractor's cooperation. The issue of contractor cooperation in this rule arises primarily in the context of Government investigation of contract fraud and corruption and any application of this rule in any other context by the Government would be clearly overreaching. g. Inadvertent Failure as Non-Cooperation One respondent feared that an “inadvertent” failure to provide documents in a routine DCAA audit would be deemed non-cooperative. Response: The rule has no application to routine DCAA audits. h. Need for Definition Many respondents asked for an expanded definition of “full cooperation” in order to reduce the potential for misinterpretation of the rule, resulting in the concerns addressed in the preceding paragraphs. Response: Contractors are not expected to block Government auditors and investigators' access to information found in documents or through its employees in furtherance of a contract fraud or corruption investigation. Generally speaking, it is also reasonable for investigators and prosecutors to expect that compliant contractors will encourage employees both to make themselves available and to cooperate with the Government investigation. That also applies to responding to reasonable Government requests for documents. Ignoring or offering little attention to detail in responding to auditor or investigator requests or subpoenas for documents or information may, in some circumstances, be obstruction of justice and, if established, certainly would not be deemed full cooperation. According to the USSG, cooperation must be both timely and thorough: • To be timely, the cooperation must begin essentially at the same time as the organization is officially notified of a criminal investigation. • To be thorough, the cooperation should include the disclosure of all pertinent information known by the organization. —A prime test of whether the organization has disclosed all pertinent information is whether the information is sufficient for law enforcement personnel to identify— —The nature and extent of the offense; and —The individual(s) responsible for the criminal conduct. —However, the cooperation to be measured is the cooperation of the organization itself, not the cooperation of individuals within the organization. If, because of the lack of cooperation of particular individual(s), neither the organization nor law enforcement personnel are able to identify the culpable individual(s) within the organization despite the organization's efforts to cooperate fully, the organization may still be given credit for full cooperation. The DoD Voluntary Disclosure Program described expected cooperation in some detail in its standard agreement (the “XYZ Agreement”), and it may be a useful reference in this circumstance where the contractor discloses credible evidence of fraud or corruption under this rule. However, the detail found there goes significantly beyond the scope of this rule and is best addressed on a case-by-case basis. The final rule includes a definition that incorporates some of the concepts in the USSG and the general principle that cooperation must be both timely and thorough. It is intended to make clear that cooperation should include all information requested as well as all pertinent information known by the contractor necessary to complete the investigation, whether the information helps or hurts the contractor. Contractors are expected to make their employees available for Government investigators and auditors investigating contract fraud and corruption and respond in a timely and complete manner to Government requests for documents and other information required to conduct an investigation of contract fraud and corruption. Responding to concerns expressed by the respondents, the Councils have incorporated the following definition into the final rule at 52.203-13(a): “ Full cooperation ”— (1) Means disclosure to the Government of the information sufficient for law enforcement to identify the nature and extent of the offense and the individuals responsible for the conduct. It includes providing timely and complete response to Government auditors' and investigators' requests for documents and access to employees with information; (2) Does not foreclose any contractor rights arising in law, the FAR, or the terms of the contract. It does not require— (i) A contractor to waive its attorney-client privilege or the protections afforded by the attorney work product doctrine; or (ii) Any officer, director, owner, or employee of the contractor, including a sole proprietor, to waive his or her attorney client privilege or Fifth Amendment rights; and (3) Does not restrict a contractor from— (i) Conducting an internal investigation; or (ii) Defending a proceeding or dispute arising under the contract or related to a potential or disclosed violation. 5. Suspension/Debarment a. New Cause for Suspension or Debarment Various respondents expressed concern that the proposed rule establishes failure to timely disclose a violation as a new cause for suspension or debarment, rather than suspension or debarment just for the underlying violation. Response: The requirement for timely disclosure could in some circumstances be considered a new cause for suspension or debarment. However, the question of timely disclosure will not come up unless the Government independently discovers that there has been a significant overpayment, a violation of the civil FCA, or a violation of Federal criminal law to be disclosed, that the Contractor knew about and elected to ignore. It is unlikely that any contractor would be suspended or debarred absent the determination that a violation had actually occurred. Present responsibility is the ultimate basis of suspension or debarment. b. Unnecessary and Not Good Policy Many respondents criticized the additional suspension and debarment coverage in the proposed rule as unnecessary and redundant to existing regulations that— • Provide strong incentives for contractors to voluntarily disclose criminal behavior; • Require a prospective contractor to demonstrate a satisfactory record of integrity and business ethics; and • Provide a “panoply of methods for prosecuting and eliminating those companies that fail to abide by the highest ethical and legal standards.” One respondent stated that the proposed suspension and debarment for “violation of Federal criminal law” simply repeats much of what is contained in FAR 9.406-2 and 9.407-2. Another respondent considered the suspension and debarment regulations punitive. Response: As addressed in the preceding paragraph, the added causes for suspension/debarment add the requirement to timely disclose the violation and are not duplicative of the violation itself as a cause for suspension/debarment. The suspension and debarment policies and standards are not punitive. The purpose of suspension and debarment is to ensure that the Government does business only with responsible contractors, not to punish. This final rule continues to embrace the responsibility standard. c. Mitigating Factors Several respondents were concerned whether the proposed rule maintains the current scheme of ten mitigating factors at FAR 9.406-1(a) or renders it meaningless by establishing failure to disclose itself as a cause for debarment (thus preventing “voluntary” disclosure). Response: The mitigating factors currently at FAR 9.406-1(a) will continue to be used, and a contractor's timely disclosure to the Government will continue to be a mitigating factor. As stated in the response in paragraph B.3.a.vi. “Incentives”, above, the incentives in the FAR and the USSG are not limited to “voluntary” disclosures but to “disclosures.” Even if disclosure is “mandatory,” incentives will still be offered to promote compliance. The Councils do not recommend any revision as a result of these comments. d. Undefined Terms Many respondents expressed concern that terms such as “knowing,” “timely” “reasonable grounds to believe,” and “overpayment” are undefined and will thus put contractors at risk. One Government respondent suggested adding “knew, should have known, or” to “had reasonable grounds to believe.” Response: See responses under paragraph B.3.b.”Vagueness of rule.” for discussions of “timely,” and “reasonable grounds to believe.” With regard to the term “knowing failure to disclose” the “knowing” refers to the failure to disclose. “Knowing failure to disclose” was added in the proposed rule to the causes for debarment at FAR 9.406-2(b)(1)(vi) and the causes for suspension at FAR 9.407-2(a)(8). Requiring a “knowledge” element to the cause for action actually provides more protection for contractors. The Councils do not agree with adding “or should have known.” The principals are only required to disclose what they know. Further, using the standard of “credible evidence” rather than “reasonable grounds to believe” will help clarify “knowing” (See response at “Vagueness of rule” at paragraph B.3.b.i., “Reasonable grounds to believe”). The term “overpayment” is described in a number of FAR clauses and provisions and does not require a definition with respect to suspension and debarment. For further discussion of overpayments, see response at “Suspension and Debarment”, paragraph B.5.f. “Limit or abandon suspension/debarment for failure to disclose overpayment”. e. Who has knowledge? One respondent stated that a contractor should be suspended or debarred for failing to disclose violations of Federal criminal law only if a “principal” of the company (as defined in the proposed contract clause) has knowledge of the crime. Failure to disclose crime should not be a basis for suspension or debarment if lower-level employees, who are not managers or supervisors, commit a crime and conceal the crime from the contractor's supervisory-level personnel. Response: Paragraph (a)(2) of the clause at FAR 52.209-5 defines “principals” to mean “officers; directors; owners; partners; and, persons having primary management or supervisory responsibilities within a business entity ( e.g. , general manager; plant manager; head of a subsidiary, division, or business segment, and similar positions)”. The Councils agree with the respondent and have revised 3.1003(a)(2), 9.406-2(b)(1)(vi), and 9.407-2(a)(8) to make disclosure mandatory when a principal of the company has knowledge. The Councils have also added the definition of a principal at FAR 2.101 because it now applies to more than a single FAR part, and revised both definitions to be singular rather than plural. The Councils note that this definition should be interpreted broadly, and could include compliance officers or directors of internal audit, as well as other positions of responsibility. f. Limit or Abandon Suspension/Debarment for Failure To Disclose Overpayment One respondent stated that the proposed ability to suspend or debar for failure to disclose an “overpayment” on a Government contract may create operational difficulties because contracts are subject to reconciliation processes with payments audited and adjusted over time. Likewise, another respondent stated that singling out routine contract payment issues, which are daily events, with errors on both sides, is simply unworkable. The respondent cites a situation where a defense contractor did disclose an overpayment to the payment office, only to be told that it was wrong, yet was later made the subject of a qui tam action. Another respondent likewise objected to making reporting of overpayments grounds for suspension or debarment rather than a matter of contract administration. The respondent stated that the proposed rule does not connect overpayments to the criminal law violations upon which the rest of the proposed rule is focused. One respondent recommended that the FAR Council should abandon the proposed changes that would make failure to disclose an “overpayment” a new cause for suspension or debarment because a number of current FAR clauses already require the contractor to disclose specific types of overpayments, e.g. , 52.232-25, 52.232-26, 52.232-27, and 52.212-4(i)(5). These clauses treat such overpayments as a matter of contract administration and do not treat them as a matter of possible fraud and a basis for suspension or debarment. In addition, the Part 9 provisions should state explicitly that the cause for suspension or debarment is for violation of the requirements in FAR 52.232-25, 52.232-26, 52.232-27, and 52.212-4(i)(5). The respondent noted that the proposed rule did not demonstrate that the present FAR provisions requiring the disclosure of overpayments are ineffective. On the other hand, another respondent stated that contractors currently have no obligation to report overpayment. One respondent was more specifically concerned that overpayments can result from indirect rate variances or similar credits that can occur years after contract performance and that can put the contractor in an over-billed situation. The severe sanctions that could inure to contractors so situated seem patently unfair. The respondent suggested either excluding rate variances or applying the section only to payments made during or immediately following contract performance. Another respondent was concerned that this ethics rule creates potential inconsistency in the treatment of overpayments with the existing regulatory provisions of the FAR, and recommends deletion of the issue of “overpayment” as a basis for suspension and debarment. DoJ suggested some answers to these concerns. DoJ considers that a duty to disclose an overpayment is just as important as the disclosure of criminal violations, and the requirement to disclose both will save the contractor from having to decide whether a criminal violation has in fact occurred in the case of an overpayment. However, DoJ concedes that a materiality requirement is appropriate to limit the scope of the requirement to disclose overpayments. Response: The Councils dispute the allegation that “contractors currently have no obligation to report overpayments” and refers the respondent to the payment clauses at FAR 52.232-25, 52.232-26, 52.232-27, and 52.212-4(i)(5). Although other clauses already require reporting of overpayment, this inclusion of the requirement in Subpart 9.4 to disclose significant overpayments is necessary to make it clear that, if a contractor does not meet this condition of the contract, it can be subject to suspension or debarment. The Councils agree with the suggestion by the DoJ that it is appropriate to limit the application of suspension or debarment to cases in which the unreported overpayment is significant. This will resolve some of the respondents' concerns over routine contract payment issues. The Councils have revised the final rule to address only significant overpayments, which implies more than just dollar value and depends on the circumstances of the overpayment as well as the amount. Since contractors are required by the Payment clauses to report and return overpayments of any amount, it is within the discretion of the suspension and debarment official to determine whether an overpayment is significant and whether suspension or debarment would be the appropriate outcome for failure to report such overpayment. Rate variances do not need to be specifically excluded by the case because this issue is already taken care of in Part 32 and the Payment clauses. Rate variances are not considered overpayments until the rates are determined. The suggestion to apply the section only to payments made during or immediately following contract performance would not necessarily exempt rate variances, depending on when the rates are determined. Further, the Councils decided to exclude knowing failure to report overpayments that result from contract financing payments, as defined in FAR 32.001, as grounds for suspension or debarment. Even though such overpayments must be reported and returned under the Payment clauses, these ongoing payments that are not the final payment on a contract are often based on estimates, and are subject to correction as the contract progresses. This rule is aimed at the type of overpayment that the contractor knows will result in unjust enrichment, and yet fails to disclose it. The Councils have ensured that there is no overlap or inconsistency between this final rule and the current FAR requirements relating to overpayment, as well as the Contract Debt case published as part of Federal Acquisition Circular 2005-27 on September 17, 2008 (73 FR 53997). g. Blacklisting One respondent had a different concern, that the proposed changes in Part 42 with regard to past performance would allow “blacklisting” of contractors through consideration of “integrity and business ethics” in the past performance evaluation without due process protections. The respondent stated that the suspension and debarment procedures are the proper means to address responsibility issues. Response: A contractor's satisfactory record of integrity and business ethics has long been one of the required elements for determining that a prospective contractor is responsible (see FAR 9.104-1(d)). The rules for assessing responsibility at FAR Subpart 9.1 provide for sufficient standards to ensure that offerors are treated fairly. FAR 15.306(b)(1) and (d)(3), and 42.1503(b) give the contractor the opportunity to comment on adverse past performance. The Councils do not recommend any change as a result of this comment. h. Amendment of the Civil FCA One respondent believed that the proposed cause for suspension/debarment language effectively amends the civil FCA. The respondent objected to changing contractors' obligations regarding overpayments without using the legislative procedure. Response: The Councils disagree that the rule intended to, or did, amend the civil FCA outside the legislative process. The civil FCA provides a legal tool to counteract fraudulent billings turned in to the Federal Government by encouraging “whistleblowers” who are not affiliated with the Government to file actions against Federal contractors, claiming fraud against the Government. It also provides incentives to contractors to self-disclose. This does not preclude the Government from imposing an obligation on Federal contractors to themselves disclose to the Government if instances of overpayment are known to the company principals, and to hold them liable for knowing failure to disclose such an overpayment. This rule provides another tool to determine present responsibility of Government contractors. FAR Subpart 9.4 provides debarment/suspension as a possible consequence for conviction of or civil judgment for commission of fraud or a variety of criminal offenses, although those statutes may already provide criminal or civil penalties for violation thereof. For example, the Sherman Act (15 U.S.C. 1-7) provides statutory penalties, including fines and imprisonment, for violation of the antitrust provisions of the statute. It is not inconsistent with the statute, nor does it require legislative amendment to include in the FAR that violation of the Federal statutes in submission of an offer is cause for debarment or suspension. i. Technical Corrections The Councils moved FAR 3.1002(c) to 3.1003(a)(2), because it presents a requirement rather than just policy guidance. In addition, the term “Mandatory” was removed from the phrase “Mandatory requirements” at 3.1003, because it is redundant. The title of paragraph (a)(1) of FAR 3.1003 has been amplified to indicate that this paragraph is describing contractor requirements. 6. Extend to Violation of Civil False Claims Act a. Support Application to Disclosure of Violations of the Civil FCA The Department of Justice, Civil Division, which is responsible for the enforcement of the civil FCA, fully supports the extension of the proposed rule to require that contractors report violations of the civil FCA, 31 U.S.C. 3729 et seq. , and to provide that the knowing failure to timely disclose such violations may be grounds for suspension or debarment. Various respondents, including agency OIGs, express support for these provisions. Response: Concur. b. Same Issues as Raised With Regard to Other Mandatory Disclosures Numerous respondents suggested that certain of their objections to the original proposal to require disclosure of criminal violations and to make a knowing failure to timely disclose such violations grounds for suspension or debarment, also apply to an expanded requirement that contractors disclose civil FCA violations. For example, some commented that disclosure should not be required because the conduct constituting violation of federal criminal law or the civil FCA is potentially broad and subject to varying interpretations by the Government, contractors and courts (and by relators in civil qui tam suits); that the requirement that violations be “timely” disclosed upon “reasonable grounds to believe” a violation has occurred are subject to varying interpretations as to when and under what circumstances a violation must be disclosed; that there is no rational basis for the proposed rule; that the rule would impose an unreasonable burden on contractors; and, that knowing failure to timely disclose should not be cause for suspension or debarment. Response: These areas of concern common to both criminal and civil violations are addressed in other sections of this report. As discussed more fully elsewhere, the Councils have replaced the “reasonable grounds to believe” standard of the proposed rule with a “credible evidence” standard in the final rule, and to specify that the violation must have a nexus to contract award, performance or close-out, and to clarify that it is the knowledge of the principal that triggers the suspension and debarment cause. See responses under “Vagueness of rule” at paragraph B.3.b.i. (Reasonable grounds to b [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3AE8-26953. Public record. Not legal advice.