What are the FAR Requirements for a Code of Business Ethics and Conduct Program?

In late 2008, the Final Rule on Contractor Code of Business Ethics and Conduct (“CoBEC”) was added to FAR Part 3 (Improper Business Practices and Personal Conflicts of Interest) in response to the heightened focus on increased lapses in corporate ethical behavior. FAR Subpart 3.10 sets forth guidance for all contractors with regard to enhanced ethical and compliance standards and requires the insertion of the clause at FAR 52.203-13 in solicitations and contracts if the value of such contract is expected to exceed $6 million, and the performance of which is 120 days or longer. DCAA focuses on compliance with FAR 52.203-13 when conducting accounting system audits.

The clause at FAR 52.203-14 is also due to be inserted in solicitations and contracts unless the contract is for the acquisition of a commercial product or commercial service, or performance will take place entirely outside of the United States. See CFR 3.1004.

What are the Specific FAR Requirements?

FAR 52.203-13(b)(1)

FAR 52.203-13(b)(1) provides the following specific CoBEC requirements:

Within 30 days after contract award, unless the Contracting Officer establishes a longer time period, the Contractor shall—

(i) Have a written code of business ethics and conduct; and

(ii) Make a copy of the code available to each employee engaged in performance of the contract.

FAR 52.203-13(b)(2)

Additionally, FAR 52.203-13(b)(2) provides that:

The Contractor shall—

(i) Exercise due diligence to prevent and detect criminal conduct; and

(ii) Otherwise promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law.

FAR 52.203-13 (b)(3)(i) – Mandatory Disclosure Rule

FAR 52.203-13 (b)(3)(i), known as the “mandatory disclosure” rule, was the subject of much debate before finalized and requires that:

The Contractor shall timely disclose, in writing, to the agency Office of the Inspector General (OIG), with a copy to the Contracting Officer, whenever, in connection with the award, performance, or closeout of this contract or any subcontract thereunder, the Contractor has credible evidence that a principal, employee, agent, or subcontractor of the Contractor has committed—

(A) A violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code; or

(B) A violation of the Civil False Claims Act (31 U.S.C. 3729-3733).

Types of issues contemplated by the mandatory disclosure rule include:

• Conflicts of Interest
• Bribes, Kickbacks and Payoffs
• Meals and Refreshments (Gratuities)
• Non-Disclosure of Confidential/Proprietary Information
• Misuse of Company and Customer Records/Property
• Labor Mis-Charging
• Violations Anti-Trust Laws
• Non-Compliance with Government Contracts
• Inappropriate Marketing Procedures (e.g., Lobbying vs. Selling)
• Inaccurate Expense Reports
• Unethical Behavior of Customers, Subcontractors, and Consultants

FAR 52.203-13(c)(1) & (2)(ii)

FAR 52.203-13(c)(1) and (2)(ii) sets forth the additional, more robust training requirements for large businesses (e.g., those that do not qualify for the small business exemption). These additional requirements include the following:

(c) The Contractor shall establish the following within 90 days after contract award, unless the Contracting Officer establishes a longer time period:

(1) An ongoing business ethics awareness and compliance program.

(i) This program shall include reasonable steps to communicate periodically and in a practical manner the Contractor’s standards and procedures and other aspects of the Contractor’s business ethics awareness and compliance program and internal control system, by conducting effective training programs and otherwise disseminating information appropriate to an individual’s respective roles and responsibilities.

(ii) The training conducted under this program shall be provided to the Contractor’s principals and employees, and as appropriate, the Contractor’s agents and subcontractors.

(2) An internal control system.

A contractor’s internal control system is required provide the assignment of responsibility at a sufficiently high level and adequate resources to ensure effectiveness of the business ethics awareness and compliance program and internal control system. In addition, the control system should include:

• periodic reviews of business practices to ensure compliance and timely discovery of improper conduct.
• a reporting mechanism, such as a hotline, that allows for anonymity and/or confidentiality.
• disciplinary action for ethical misconduct.

FAR 52.203-14

FAR 52.203-14 requires the display of any agency fraud hotline poster and any Department of Homeland Security fraud hotline poster identified by the Contracting Officer. If the Contractor has a company website that is used to provide information to its employees, an electronic version of these posters must also be displayed on such website. However, if the Contractor has implemented a business ethics and conduct awareness program (i.e., a written Code of Ethics and Business Conduct AND training) which includes a reporting mechanism, then the agency fraud hotline posters does not have to be displayed.

Voluntary Self-Disclosure Policy

In February 2023, the Department of Justice (DOJ) announced a Voluntary Self-Disclosure Policy (VSD Policy) for all U.S. Attorney’s Offices, establishing nationwide incentives for voluntary corporate disclosures. These voluntary reports may be satisfied by following the mandatory disclosure requirements of FAR; however, a separate disclosure directly to DOJ is required to seek “cooperation credit” from DOJ.

Qualifications necessary for a “Voluntary Self-Disclosure” include the following:

• Voluntariness: The disclosures must be truly voluntary as opposed to a “preexisting obligation to disclose.”
• Timeliness: The disclosure must be made promptly and prior to “imminent threat of disclosure or government investigation,” or existing public disclosure or government knowledge.
• Completeness: The disclosure must include “all relevant facts concerning the misconduct” known to the company at the time of disclosure.

The benefits of participating in the voluntary self-disclosure policy include:

• Avoidance of a criminal penalty if there are no aggravating circumstances.
• Even with aggravating factors, a reduction of between 50% to 75% of the U.S. Sentencing Guidelines fine range may be applied.
• Avoidance of the appointment of an external compliance monitor.

Notable Mitigating Factors

In the event of any violations, the government may consider the following as “notable mitigating factors” when determining the outcome of an investigation or audit:

• Whether the contractor had effective standards of conduct and internal control systems in place at the time of the misconduct, and prior to the time the government learned of it;
• Whether the contractor instituted review and control procedures and ethics training programs;
• Whether appropriate disciplinary action was taken;
• Whether the contractor has eliminated the circumstances within its organization that led to the misconduct; and
• Whether management recognizes the seriousness of this misconduct and has implemented programs to prevent recurrence.

Recommended Best Practices

• Tone at the Top – promote an ethical culture committed to compliance with all laws.
• Establish a written Code of Business Ethics and Conduct and appoint a Compliance Officer
• Establish an Awareness/Training Program and ensure dissemination of information appropriate to each individual employees’ respective roles and responsibilities.
• Periodic reviews of company’s business practices and procedures to ensure ongoing compliance and facilitate timely discovery of potentially improper conduct.
• Internal hotline or other anonymous reporting mechanism.
• Establish protocols for intake and processing of allegations of potential misconduct – include documentation that investigation of allegations will be conducted at the express direction of counsel to.
• Conduct a neutral, timely investigation of any allegations or potential issues.
• Guarantee that effective corrective measures are taken.
• Ensure no retaliation against whistleblowers.
• Make mandatory disclosures as required.
• Fully cooperate with any Government agency responsible for audit, investigations, or corrective action.
• Flow-down requirements to subcontractors with subcontracts that exceed the threshold specified in FAR 3.1004(a) on the date of the award (currently $6 million) and a period of performance over 120 days.
• While only larger companies are required to have a formal training program, companies of all sizes must have a written policy and provide it to their employees. Since even small businesses are at risk for ethical issues, we recommend training to ensure management and all employees have a fundamental awareness of the ethics requirements.

Redstone GCI understands that compliance with federal government regulations is challenging. Our team assists contractors throughout the U.S. and internationally with understanding the Government’s expectations and supporting contractors from contract award to contract closeout. We are available to assist you in developing a Code of Business Ethics and Conduct policy and awareness program, development of internal controls to ensure compliance and understanding your obligations with regard to mandatory and voluntary self-disclosure.