[Federal Register Volume 73, Number 219 (Wednesday, November 12, 2008)]
[Rules and Regulations]
[Pages 67064-67093]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: E8-26953]


-----------------------------------------------------------------------

DEPARTMENT OF DEFENSE

GENERAL SERVICES ADMINISTRATION

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

48 CFR Parts 2, 3, 9, 42 and 52

[FAC 2005-28; FAR Case 2007-006; Item I; Docket 2007-001; Sequence 11]
RIN 9000-AK80


Federal Acquisition Regulation; FAR Case 2007-006, Contractor 
Business Ethics Compliance Program and Disclosure Requirements

AGENCIES: Department of Defense (DoD), General Services Administration 
(GSA), and National Aeronautics and Space Administration (NASA).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Civilian Agency Acquisition Council and the Defense 
Acquisition Regulations Council (Councils) have agreed on a final rule 
amending the Federal Acquisition Regulation (FAR) to amplify the 
requirements for a contractor code of business ethics and conduct, an 
internal control system, and disclosure to the Government of certain 
violations of criminal law, violations of the civil False Claims Act, 
or significant overpayments. This final rule implements Pub. L. 110-
252, Title VI, Chapter 1.

DATES: Effective Date: December 12, 2008.
    Applicability: The Contractor's Internal Control System shall be 
established within 90 days after contract award, unless the Contracting 
Officer establishes a longer time period (See FAR 52.203-13(c)). The 
Internal Control System is not required for small businesses or for 
commercial item contracts.

FOR FURTHER INFORMATION CONTACT: Mr. Ernest Woodson, Procurement 
Analyst, at (202) 501-3775 for clarification of content. For 
information pertaining to status or publication schedules, contact the 
FAR Secretariat at (202) 501-4755. Please cite FAC 2005-28, FAR case 
2007-006.

SUPPLEMENTARY INFORMATION: 

Table of Contents

A. Background
B. Discussion and Analysis
    1. Interrelationship of previous final rule, first proposed 
rule, second proposed rule, and new statute.
    2. Mandatory standards for internal control system.
    3. Mandatory disclosure to the OIG.
    4. Full Cooperation.
    5. Suspension/Debarment.
    6. Extend to violation of civil False Claims Act.
    7. Application to acquisition of commercial items.
    8. Application to contracts to be performed outside the United 
States.
    9. Other applicability issues.
    10. Additional recommendations.
    11. Regulatory Flexibility Act concerns.
    12. Paperwork Reduction Act (PRA).
    13. E.O. 12866.
C. Regulatory Flexibility Act
D. Paperwork Reduction Act

[[Page 67065]]

A. Background

    This case is in response to a request to the Office of Federal 
Procurement Policy from the Department of Justice, dated May 23, 2007, 
and the Close the Contractor Fraud Loophole Act, Public Law 110-252, 
Title VI, Chapter 1. This final rule amends the Federal Acquisition 
Regulation to require Government contractors to--
     Establish and maintain specific internal controls to 
detect and prevent improper conduct in connection with the award or 
performance of any Government contract or subcontract; and
     Timely disclose to the agency Office of the Inspector 
General, with a copy to the contracting officer, whenever, in 
connection with the award, performance, or closeout of a Government 
contract performed by the contractor or a subcontract awarded 
thereunder, the contractor has credible evidence of a violation of 
Federal criminal law involving fraud, conflict of interest, bribery, or 
gratuity violations found in Title 18 of the United States Code; or a 
violation of the civil False Claims Act (31 U.S.C. 3729-3733).
     The rule also provides as cause for suspension or 
debarment, knowing failure by a principal, until 3 years after final 
payment on any Government contract awarded to the contractor, to timely 
disclose to the Government, in connection with the award, performance, 
or closeout of the contract or a subcontract thereunder, credible 
evidence of--
    A. Violation of Federal criminal law involving fraud, conflict of 
interest, bribery, or gratuity violations found in Title 18 of the 
United States Code;
    B. Violation of the civil False Claims Act; or
    C. Significant overpayment(s) on the contract, other than 
overpayments resulting from contract financing payments as defined in 
FAR 32.001, Definitions.
    DoD, GSA, and NASA published a proposed rule in the Federal 
Register at 72 FR 64019, November 14, 2007, entitled ``Contractor 
Compliance Program and Integrity Reporting.'' The public comment period 
closed on January 14, 2008. (This was a follow-on case to the final 
rule under FAC 2005-22, FAR case 2006-007 that was published in the 
Federal Register at 72 FR 65868, November 23, 2007, effective December 
24, 2007.) A second proposed rule was published in the Federal Register 
at 73 FR 28407, May 16, 2008, entitled ``Contractor Compliance Program 
and Integrity Reporting.'' The public comment period on the second 
proposed rule closed on July 15, 2008.
    On June 30, 2008, the Close the Contractor Fraud Loophole Act (Pub. 
L. 110-252, Title VI, Chapter 1) was enacted as part of the 
Supplemental Appropriations Act, 2008. This Act requires revision to 
the FAR within 180 days of enactment, pursuant to 2007-006, ``or any 
follow-on FAR case to include provisions that require timely 
notification by Federal contractors of violations of Federal criminal 
law or overpayments in connection with the award or performance of 
covered contracts or subcontracts, including those performed outside 
the United States and those for commercial items.'' The statute also 
defines a covered contract to mean ``any contract in an amount greater 
than $5,000,000 and more than 120 days in duration.''
    First proposed rule. The first proposed rule, published in the 
Federal Register on November 14, 2007, proposed the following:
    1. New causes for suspension/debarment. A contractor may be 
suspended and/or debarred for knowing failure to timely disclose--
     An overpayment on a Government contract; or
     A violation of Federal criminal law in connection with the 
award or performance of any Government contract or subcontract.
    2. Changes to the requirement for a code of business ethics and 
conduct (52.203-XX).
     Amplify the requirement to promote compliance with the 
code of business ethics.
     Require timely disclosure to the agency Office of the 
Inspector General (OIG), with a copy to the contracting officer, 
whenever the contractor has reasonable grounds to suspect a violation 
of criminal law in connection with the award or performance of the 
contract or any subcontract thereunder.
    3. Mandatory requirements for internal control system based on U.S. 
Sentencing Guidelines (USSG).
     Provide more detail with regard to the ongoing business 
ethics awareness and compliance program (see 52.203-XX 
paragraph(c)(1)).
     Make all the stated elements of the internal control 
system mandatory, rather than examples (see 52.203-XX (c)(2)(ii)).
    A. Add a new paragraph requiring assignment of responsibility 
within the organization for the ethics awareness and compliance program 
and internal control system.
    B. Require reasonable efforts not to include as principals 
individuals who have engaged in illegal conduct or conduct otherwise in 
conflict with the contractor's code of business ethics and conduct.
    C. Provide additional detail with regard to the requirement for 
periodic reviews.
    D. Require that the internal reporting mechanism or hotline must 
allow for anonymity or confidentiality.
    E. Provide that disciplinary action will be taken not only for 
improper conduct, but also for failing to take reasonable steps to 
prevent or detect improper conduct.
    F. Require timely disclosure, in writing, to the agency OIG, with a 
copy to the contracting officer, whenever the contractor has reasonable 
grounds to believe that a violation of Federal criminal law has been 
committed in connection with the award or performance of any Government 
contract performed by the contractor or the award or performance of a 
subcontract thereunder.
    G. Require full cooperation with any Government agencies 
responsible for audit, investigation, or corrective actions.
    Second proposed rule. The second proposed rule, published in the 
Federal Register on May 16, 2008, proposed the following:
    1. Require inclusion of the clause at FAR 52.203-13 in contracts 
and subcontracts that will be performed outside the United States.
    2. Require inclusion of the clause at FAR 52.203-13 in contracts 
(and subcontracts) for all acquisitions of a commercial item. However, 
similar to small businesses, a formal business ethics awareness and 
compliance program and internal control system are not required in 
contracts and subcontracts for the acquisition of commercial items.
    3. Add a new cause for suspension and/or debarment, i.e., knowing 
failure to timely disclose the violation of the civil False Claims Act 
(civil FCA) in connection with the award or performance of any 
Government contract or subcontract.
    The first two of these three proposed changes are now required by 
statute (Pub. L. 110-252, Title VI, Chapter 1). (As pointed out by one 
of the respondents, there was an error in the amendatory language in 
the Federal Register. At FAR 3.1004, the introductory text should have 
been deleted, rather than showing 5 asterisks, indicating that the 
introductory text is still present. However, the preamble made our 
intent very clear and this will be clarified in the final rule).
    Rule on Contract Debts. DoD, GSA, and NASA published a proposed 
rule, FAR case 2005-018, in the Federal

[[Page 67066]]

Register at 71 FR 62230, October 24, 2006, regarding contract debts. 
The final rule was published in the Federal Register at 73 FR 53997, 
September 17, 2008, as part of Federal Acquisition Circular 2005-27. 
The intent of this rule is to evaluate existing controls and procedures 
for ensuring that contract debts are identified and recovered in a 
timely manner, properly accounted for in each agency's books and 
records, and properly coordinated with the appropriate Government 
officials.
    One of the following payment clauses should be included in each 
Government solicitation and contract:

--52.212-4, Contract Terms and Conditions--Commercial Items, basic 
clause and Alternate I.
--52.232-25, Prompt Payment.
--52.232-26, Prompt Payment for Fixed-Price Architect-Engineer 
Contracts.
--52.232-27, Prompt Payment for Construction Contracts.
    These Payment clauses for years have contained the requirement to 
immediately notify the contracting officer if the contractor becomes 
aware of any overpayment on a contract financing or invoice payment. 
Compliance with this requirement fulfills the statutory requirement of 
Pub. L. 110-252 for timely notification of overpayments.
    In addition, under the Contract Debts rule, these Payment clauses 
were modified to require that if the contractor becomes aware of a 
duplicate contract financing or invoice payment or if the contractor 
becomes aware that the Government has otherwise overpaid on a contract 
financing or invoice payment, the contractor shall--
     Remit the overpayment amount to the payment office cited 
in the contract along with a description of the overpayment; and
     Provide a copy of the remittance and supporting 
documentation to the contracting officer.
    Because issues of overpayment were addressed in FAR case 2005-018, 
the Councils did not include additional coverage on contract debt in 
the subject FAR Case, except for adding--
     Knowing failure to timely disclose significant overpayment 
as a cause for debarment/suspension as stated at Subpart 9.4 Debarment, 
Suspension, and Ineligibility; and
     A cross reference at 3.1003(a)(3) to this new cause of 
suspension/debarment at Subpart 9.4.

B. Discussion and Analysis

    The FAR Secretariat received 43 responses to the first proposed 
rule. The FAR Secretariat received comments on the second proposed rule 
from 25 respondents of which 15 respondents had also submitted comments 
on the first proposed rule and 10 respondents were submitting comments 
for the first time. Overall, 18 of the 53 respondents were from 
Government agencies, including many responses from agency Offices of 
the Inspector General (OIG).
    In the second proposed rule the Councils specifically requested 
comments on three issues:
     Elimination of the exemption from inclusion of the clause 
FAR 52.203-13 for contracts and subcontracts that will be performed 
entirely outside the United States.
     Elimination of the exemption from inclusion of the clause 
FAR 52.203-13 for contracts (and subcontracts) for all acquisitions of 
a commercial item under FAR Part 12.
     Requirement for mandatory disclosure of violations of the 
civil FCA (31 U.S.C. 3729-3733) (in the clause, in the internal control 
system required by the clause, and as a cause for suspension or 
debarment).
    Comments on the second proposed rule that do not relate to these 
three issues, unless presenting a new and pertinent perspective, have 
not been separately addressed in this preamble.

1. Interrelationship of Previous Final Rule, First Proposed Rule, 
Second Proposed Rule, and New Statute

a. Previous Final Rule, FAR Case 2006-007
    The first proposed rule under FAR case 2007-006 (``first proposed 
rule''), proposed increases to the requirements introduced by final 
rule, FAR case 2006-007 (``previous final rule''), in the ways 
enumerated in the Background section above. Thirteen respondents 
remarked on the relationship to the previous final rule, some 
suggesting changes to the previous final rule as well as the first 
proposed rule.
    i. Like the previous final rule under 2006-007.
     No further change needed. One respondent expressed the 
belief that the previous final rule is adequate to protect the 
Government's interest. Several other respondents supported the previous 
final rule's voluntary disclosure. One respondent questioned the need 
for the first proposed rule in light of the recent implementation of 
``more expansive contractor compliance standards in the FAR.''
     The first and second proposed rules enhance the previous 
rule. One Government agency explicitly supported the major provisions 
of both rules as sound business practices, highlighting their 
contribution to cost control as well as mission safety.
    Response: No response necessary.
    ii. Ethics code. With regard to the requirement for a code of 
conduct, one respondent considered that just having a code is 
meaningless. Several other respondents also objected to the requirement 
for a code of business ethics and conduct in the previous final rule 
under FAR case 2006-007, stating that existing contractor ethics 
standards work well and that these contractual requirements are 
redundant, add costs and other burdens, and are likely to generate 
additional uncertainties.
    Several respondents objected to the outdated method of 
communicating the code, requiring a copy to each employee engaged in 
the contract. One respondent recommended that it may be more effective 
to refer employees to Web sites or provide tutorials in person, on-
line, or through other means. This suggestion could minimize burdens 
through the use of information technology, as requested in the preamble 
to the proposed rule for this case.
    Another respondent also objected that many institutions have more 
than a single code of conduct, each addressing different aspects of 
conduct that together cover all aspects of conduct that the FAR rule 
requires.
    Response: The Councils do not agree that a code of conduct is 
meaningless. It can serve several related purposes. For a firm's 
business partners, including the Government, it provides a basis for 
evaluating the firm's responsibility, including special standards of 
responsibility when appropriate. It also provides a basis for internal 
policy development, for example human resources policies. And when 
something goes wrong, the code is meaningful for enforcement and for 
understanding and perhaps incorporating lessons learned.
    While requiring establishment of a code will add costs and require 
effort on the part of entities that do not have them already, the 
Councils agree with several respondents that those resources are 
reasonable and justified to mitigate other and larger risks to the 
success and efficiency of Government projects. Because many entities 
already have made the investment, the rule will level the playing field 
in competitive environments.
    The Councils agree that flexibility in the method of communicating 
the code to employees is appropriate, and the rule has been changed to 
require that it be made available to each employee engaged in 
performance of the contract. The Councils note that the rule does not 
preclude having multiple codes of

[[Page 67067]]

conduct applicable to different segments of contractors' business 
lines.
    iii. Training.
     Training requirement is too burdensome. One respondent was 
concerned that the requirements for training could take substantial 
time away from performing on their contracts to train staff on an 
unknown scope of Federal criminal law. The Government would incur costs 
from this activity through delays in the fulfillment of contracts and 
increased contractor expenses that will be passed along to customers.
    Response: The Councils recognize that contract costs are reflected 
in prices, but do not consider schedules to be impacted by this 
requirement. By identifying the scope of violations of the Federal 
criminal law as those involving fraud, conflict of interest, bribery, 
or gratuity violations found in Title 18 of the United States Code, the 
Councils believe that the training requirements have been more clearly 
defined and the contractor's training requirement has been reduced.
     Require training on civil FCA. Several respondents 
proposed that Government contractors be required to educate their 
employees about the protections available under the civil FCA. The 
Department of Justice, Criminal Division (DoJ) suggested that 
contractors should also be required to include in their ``business 
ethics awareness'' obligation, reflected in the proposed rule at FAR 
52.203-13(c)(2)(ii)(F), training on the civil FCA.
    Response: The Councils do not agree that it is necessary under this 
case to dictate to contractors what they need to cover in business 
ethics training. If we highlight education on the civil FCA, or other 
specific areas, the contractors may place undue emphasis only on those 
areas mentioned in the regulations. The business ethics training 
courses may cover appropriate education on the civil FCA, as well as 
many other areas such as conflict of interest and procurement integrity 
and other areas determined to be appropriate by the contractor, 
considering the relevant risks and controls.
    iv. Hotline posters. One respondent commented that the physical 
display of multiple hotline posters in common work areas is impractical 
and wasteful. Another respondent also objects to using hotline posters 
on the walls of the institution as being the most effective way of 
communication at every institution.
    Response: The issue of multiple hotline posters was resolved under 
the final rule 2006-007. The requirement for hotline posters is outside 
the scope of this case.
b. Relationship of Second Proposed Rule to First Proposed Rule
    One respondent questioned whether certain requirements of the first 
proposed rule that did not appear in the second proposed rule had been 
deleted.
    Response: The preamble of the second proposed rule specified that 
it included only the sections of the rule affected by the three 
changes; it was only addressing three issues, not providing a 
completely revised proposed rule. Therefore, the fact that language in 
the first proposed rule that would not be affected by the 3 issues of 
concern was not repeated in the second proposed rule does not imply 
that that language was being deleted.
c. Relationship of Second Proposed Rule to New Statute
    One respondent recommends that any disclosure requirement be 
limited to violations of the types specified in the ``Closing the 
Contractor Fraud Loophole Act (Pub. L. 110-252, Title VI, Chapter 1)'' 
(i.e., exclude violations of the civil FCA). This respondent also 
states that the statute does not require the disclosure to the OIG and 
the penalties of debarment/suspension are not required by the new 
statute, so should be eliminated.
    Another respondent also makes the point that since the new law does 
not address disclosure of violations of the civil FCA, that requirement 
should not be included in the final rule under this case.
    One respondent notes particularly that the new law does not require 
the ``reasonable grounds to believe'' standard, reporting to the 
Inspector General, or failure to report as an independent basis for 
suspension or debarment.
    Response: This rule was initiated as a matter of policy. Although 
the new statute reinforces and provides a statutory basis for some 
aspects of the rule, the fact that any part of the rule is not required 
by statute does not alter the rationale that provided the underpinning 
for those aspects of the rule. Each aspect of the rule not required by 
statute must be considered on its own merits.

2. Mandatory Standards for Internal Control System

a. Minimum Requirements for the Internal Control System
    One respondent considered that the previously recommended, now 
mandatory, internal control practices will be inadequate if they are 
considered to be maximum as well as minimum requirements. Another 
respondent considered the establishment of an internal control system 
that satisfies a laundry list of mandates will be overly burdensome. 
Another respondent would prefer that contractors be left free to choose 
to implement the USSG ``in the prudent exercise of their business 
discretion,'' rather than being required to do so. Likewise, another 
respondent stated that contractors may want to consider the USSG in 
designing compliance programs but, absent a statute or Executive order, 
they should not be made mandatory in the regulations.
    Response: The rule does reflect minimum expectations. Competing 
firms are free to establish the highest ethical standards they consider 
to be appropriate to the business at hand. This case establishes a 
framework for institutional ethics management and disclosure and does 
not prescribe specific ethical requirements.
b. Relation of Rule to the USSG
    i. Rule is consistent with the USSG. An agency OIG stated that the 
proposed rule should benefit Federal contractors. It provides guidance 
for contractors consistent with U.S. Sentencing Commission guidance on 
effective compliance and ethics programs for organizations. Compliance 
with the rule should assist contractors subject to the Sarbanes-Oxley 
Act of 2002 in fulfilling their responsibilities under the Act.
    Response: None needed.
    ii. USSG should be incorporated by reference. Several respondents 
commented that rather than using the ad hoc form of the USSG standards 
for compliance and ethics program, the actual USSG standards should 
simply be incorporated by reference. Conformity with the USSG will 
prevent contractors unknowingly failing to comply with all the USSG 
although complying with the FAR. Formal adoption of the USSG will 
create uniform criteria. A respondent recommended that all the 
descriptive paragraphs in (ii) be deleted, instead inserting: ``The 
Contractor's internal control system shall provide for a compliance and 
ethics program that meets the standards of the Federal Organizational 
Sentencing Guidelines, as amended from time to time, United States 
Sentencing Commission Guidelines Manual: Sentencing of Organizations, 
section 8B2.1.
    Response: These respondents would use the USSG Guidelines, in place 
of the FAR spelling out the required elements of internal control 
systems. However,

[[Page 67068]]

the Councils prefer to spell out the elements. This lets the 
contractors know what is expected. The USSG are the source of the FAR 
text, but the FAR text is intentionally not adopting them verbatim. The 
procurement regulations are not the USSG; the contractor setting up an 
internal control system is in a different situation than a company 
accused of a crime. Some elements of the USSG are not appropriate for a 
procurement regulation. However, by making the minimum requirements 
generally consistent with the USSG, the Councils believe that a 
contractor should be in a better position if accused of a crime.
    iii. Essential parts of the USSG are missing. One respondent 
commented that essential parts of the USSG are missing. One example is 
the reference to the use of an incentive system in compliance programs 
that encourages and rewards companies for implementing effective 
programs, following the model of the Organizational Sentencing 
Guidelines. The respondent recommends modifying 52.203-13(c)(1)(ii)(E) 
by inserting after ``detect improper conduct'' the words ``and 
appropriate incentives to perform in accordance with the compliance and 
ethics program''.
    Another example the respondent uses is the standard for effectively 
responding to violations, and taking steps to prevent recurrence. 
Without these, a company's program would not be considered effective 
under the USSG.
    Response: The Councils note that the respondent must have intended 
to cite FAR 52.203-13(c)(2)(ii)(E). The Councils do not want to require 
incentives for employees within contractors' internal control systems. 
This is within companies' discretion. The mitigating factors for 
debarment (9.406-1(a)) already include consideration of remedial action 
(e.g., (6), (7), and (8)) taken by the contractor.
    The FAR does cover responding to violations, and preventing 
recurrence, in FAR 52.203-13(c)(2)(i), and throughout (c)(2)(ii).
c. Principals
    Several respondents asked for interpretation of the clause 
paragraph (c)(2)(ii)(B) requirement that the internal control system 
provide for reasonable efforts not to include within the organization 
principals whom due diligence would have exposed as having engaged in 
conduct that is illegal or otherwise in conflict with the Contractor's 
code of business ethics and conduct.''
     Is the ``organization'' the entire contractor, instead of 
the organization responsible for the code?
     Is the code retroactive to catch criminal behavior in the 
past?
     Is it only Federal crimes, or state and local as well?
     What about non-criminal behavior that did not violate the 
Contractor's code at the time?
     What kind of due diligence is necessary--a simple pre-
employment questionnaire, or instead a costly background check with 
interviews of friends and neighbors?
    Response:
     The Councils have revised the draft final rule (paragraphs 
(c)(2)(ii)(A), (B), and (C) of the clause 52.203-13) to eliminate use 
of the term ``organization''. This term was a carryover from the USSG. 
This rule is addressed to the contractor--the entity that signed the 
contract, and subcontractors thereunder.
     The code of conduct is not itself retroactive. However, it 
is necessary to distinguish conduct of an employee during his/her 
employment, from past conduct uncovered during a background check of a 
prospective hire. That past conduct need not be disclosed to the 
Government, but should be part of the decision whether to hire the 
individual.
     Past criminal behavior of any type, even criminal behavior 
unrelated to contracting, calls into question whether the individual at 
the present time has integrity and is a proper role model for company 
staff. This is not a mandate to fire the individual, but to determine 
whether the individual is currently trustworthy to serve as a principal 
of the company.
     Behavior that was not criminal and did not violate a 
business's code as it existed at the time, is not the subject of this 
rule. In response to this comment, the Councils have revised paragraph 
(c)(2)(ii)(B) to delete the words ``illegal or otherwise.'' The term 
``illegal'' is too broad and could include even a traffic violation. 
The Contractor's code of business ethics and conduct should cover the 
types of behavior that this requirement is intended to address.
     The level of background check required depends on the 
circumstances. This is a business decision, requiring judgment by the 
contractor.
    The source of the FAR clause paragraph (c)(2)(ii)(B) is the USSG 
Manual paragraph 8B2.1.(b)(3). The Commentary on this paragraph 
includes this statement: ``With respect to the hiring or promotion of 
principals, an organization shall consider the relatedness of the 
individual's illegal activities and other misconduct (i.e., other 
conduct inconsistent with an effective compliance and ethics program) 
to the specific responsibilities the individual is anticipated to be 
assigned and other factors such as: (i) the recency of the individual's 
illegal activities and other misconduct; and (ii) whether the 
individual has engaged in other such illegal activities and other such 
misconduct.''
d. Periodic Review
    One respondent asked for an interpretation of the clause paragraph 
(c)(2)(ii)(C) requirement for periodic review of business practices. 
For ``monitoring and auditing'', is standard business practice and 
generally acceptable accounting principals sufficient? What system for 
assessing the ``risk of criminal conduct'' would be sufficient? Is 
there a Government program that is an acceptable process?
    Response: Standard business practice for ``monitoring and auditing 
to detect criminal conduct'' which conforms to generally accepted 
accounting principles should be sufficient. The ``monitoring and 
auditing'' is amplification of the current FAR requirement for periodic 
review and auditing, from the FAR case 2006-007 published in November 
2007.
    One respondent stated that annual audits of research processes may 
already review compliance with policies for ethical conduct of research 
funded under Federal contracts. The FAR can acknowledge, through an 
Alternate to the clause, that duplication of review is not required 
where reviews under other rules already cover the necessary subjects.
    Response: The FAR is not requiring wasted duplication of effort. No 
change to the regulation is necessary.

3. Mandatory Disclosure to the OIG

    Of the 43 respondents that commented on the first proposed rule, 36 
commented specifically on sub-paragraph (b)(3) of the clause 52.203-13, 
Contractor Code of Business Ethics and Conduct, which requires 
mandatory disclosure, in writing, to the agency OIG, with a copy to the 
contracting officer, whenever the contractor has reasonable grounds to 
believe that a principal, employee, agent, or subcontractor of the 
contractor has committed a violation of Federal criminal law in 
connection with the award or performance of the contract or any 
subcontract thereunder.
    Six agency OIGs, as well as several Government agencies all 
specifically concurred with the mandatory disclosure of violations by 
contractors.

[[Page 67069]]

    Other respondents, including agency OIGs, while concurring with 
mandatory disclosure, suggested improvements in the way this 
requirement is implemented in the rule.
    The other 17 respondents that commented specifically on the 
mandatory disclosure disagreed with this approach and recommended 
voluntary disclosure.
a. Need for Mandatory Disclosure
    Note that the following comments in this section all preceded the 
enactment of the statute that requires mandatory disclosure, so that 
the issues are now primarily moot.
    i. Major departure from long-standing policy. One respondent stated 
that this rule is a major departure from long-standing and proven 
Federal policies that encourage voluntary disclosures. Likewise, 
another respondent stated that mandatory disclosure runs counter to 
many established Government processes. One respondent considered the 
proposed regulation to be a ``sea change'' in the fundamental approach 
to compliance followed by the Government. Another respondent noted that 
in 1986 a proposal from DoD to make fraud disclosures mandatory 
foundered on ``state action'' grounds. In 1988, then Secretary of 
Defense Richard Cheney withdrew a proposed rule that would have 
governed such programs on the grounds that ``to be meaningful, 
corporate codes of conduct must be adopted by contractors voluntarily, 
not mandated in procurement regulations (54 FR 30911)''. Another 
respondent also cited a 1996 GAO report on the DoD Voluntary Disclosure 
Program (GAO/NSIAD-96-21) in which the GAO quotes the DoJ as praising 
the DoD Voluntary Disclosure Program.
    Several respondents cited the DFARS regulations as being a model 
for voluntary disclosure. Several other respondents stated that many 
Federal agencies that have considered mandatory disclosure rules have 
declined to adopt them in favor of voluntary disclosure programs (e.g., 
Department of Health and Human Services in 2000 (65 FR 40170) and in 
2004 (69 FR 46866)).
    Response: There is no doubt that mandatory disclosure is a ``sea 
change'' and ``major departure'' from voluntary disclosure, but DoJ and 
the OIGs point out that the policy of voluntary disclosure has been 
largely ignored by contractors for the past 10 years. In addition, in 
that same time period mandatory disclosure has been adopted for banks 
and public companies and stressed by the U.S. Sentencing Commission and 
DoJ, as further discussed in the following sections.
    ii. Is voluntary disclosure working? Various respondents stated 
that the proposed rule fails to demonstrate that there is a need for 
change based on failure of voluntary disclosure. According to these 
respondents, neither DoJ nor the Councils have cited data supporting 
the claim that voluntary disclosure is not effective. One respondent 
stated that a purported paucity of participants in the DoD IG Voluntary 
Disclosure Program does not establish a decline in contractor 
disclosures to the Government sufficient to justify a mandatory 
disclosure requirement. Another respondent stated that DoJ is comparing 
the last few years to data from 20 years ago. One respondent cited 
disclosures for FY 2005-2007 that are relatively level. Another 
respondent cited the December 2006 issue of Corporate Counsel that 
voluntary disclosures are increasing rather than decreasing, citing Mr. 
Mark Mendelssohn of DoJ and a recent report by Sherman & Sterling. Even 
if there is a decline in disclosure under the DoD Voluntary Disclosure 
Program, another respondent found that the leap to mandatory disclosure 
``gives rise to a perverse implication that justification for mandating 
regulations can be asserted simply because no one has shown that the 
activity to be regulated is not happening.''
    One respondent stated that the assumptions about the reason for the 
decrease are misplaced. Another respondent firmly believed that there 
is need for analysis of the reasons for any decline in voluntary 
disclosures. Even if mandatory disclosures to the DoD IG Voluntary 
Disclosure Program are decreasing, several respondents suggested the 
following possible explanations:
     Less emphasis by DoD.
     Fewer reportable violations.
     More instances resolved as contract matters, with reports 
to contracting officers or heads of contracting activities or to audit 
agencies like DCAA and DCMA.
     Perception that the Government is slow in processing 
voluntary disclosures.
     Lack of restrictions on use of disclosure reports in 
criminal or civil actions or in administrative actions against 
individuals.
    One respondent elaborated that there may be fewer voluntary 
disclosures because self-governance is working to prevent and detect 
contract formation and contract performance issues before they result 
in criminality or civil fraud. Reduction in the rate of voluntary 
disclosures would be an expected byproduct of improved internal 
processes, enhanced training, better internal controls, and an improved 
culture of ethics and compliance.
    One respondent stated that a number of companies have commented 
that delays in processing disclosures to the OIG are a significant 
factor in their decision to report problems to the contracting officer 
instead of to the DoD Voluntary Disclosure Program.
    One respondent suggested other avenues for disclosure that are more 
relevant to the kinds of illegal activity being found these days, such 
as--
     The DoJ Antitrust Division. Voluntary disclosures to DoJ 
have increased as disclosures to the DoD IG program have decreased (see 
http://www/usdoj.gov/atr/public/speeches/232716.htm#N_1_);
     The Department of State Directorate of Defense Trade 
Controls. This program has been very successful at inducing voluntary 
disclosures (see GAO-05-234 (Feb 2005)); and
     Foreign Corrupt Practices Act. Enforcement actions for 
violations of the FCPA have also grown, again largely due to voluntary 
disclosures made by corporations (see ``U.S. Targets Bribery Overseas 
Globalization; Reforms Give Rise to Spike in Prosecutions,'' The 
Washington Post (Dec 5, 2007)).
    One respondent suggested that mandatory reporting should be 
replaced with a strong voluntary disclosure program modeled after the 
DoJ Antitrust Division's Corporate Leniency Programs.
    Another respondent noted that it is DoJ, not DoD, that apparently 
believed that the mandatory disclosure provisions were necessary. This 
respondent interpreted this to mean that DoD is satisfied with the 
number and types of disclosures being made.
    One respondent stated that DoJ should be required to demonstrate 
that there is an upward trend of criminal prosecutions of the top 100 
Government contractors where it was established that contractor 
principals were aware of violations of the law and made a conscious 
decision not to disclose those violations to the Government. Similarly, 
another respondent suggested that DoJ should offer factual support for 
its thesis that crimes are occurring and being found and yet not being 
reported voluntarily. One respondent also wanted DoJ to explain why 
other less burdensome changes, such as improving the existing voluntary 
disclosure programs, cannot be used to achieve the desired result.
    On the other hand, in the DoJ letter of May 23, 2007, DoJ stated 
that its

[[Page 67070]]

experience suggests that few corporations have actually responded to 
the invitation of DoD that they report or voluntarily disclose 
suspected instances of fraud. An agency OIG stated that the vast 
majority of crimes involving contractors that it investigates are not 
reported by the contractor. Another agency OIG stated that Government 
contractors are coming forward significantly less frequently with 
voluntary disclosures. It considered that this mandatory requirement 
may be the most effective way for the Government to monitor its 
vendors.
    Response: In the DoJ letter dated May 23, 2007, which requested the 
Administrator of the Office of Federal Procurement Policy, Mr. Paul 
Denett, to open this case, DoJ states that its experience suggests that 
few companies have actually responded to the invitation of DoD to 
report or voluntarily disclose suspected instance of fraud. The 
respondents do not dispute that relatively few contractors are using 
the DoD Voluntary Disclosure Program. The contractor groups, in their 
public comments on the rule, implicitly concede that the Voluntary 
Disclosure program is not being used and blame DoJ and the OIG. Some 
claim that informal disclosures are being made to the contracting 
officers but offer no specific evidence.
    Even if it is true that there are comparatively fewer violations 
now than 20 years ago or that some situations are resolved 
administratively, there are still significant numbers of violations 
occurring and being prosecuted that have not been self-disclosed.
    Importantly, the incentive to self-disclose Antitrust violations is 
not applicable. Antitrust deals with the Sherman Act and the Clayton 
Act, which prohibit conspiracy in restraint of interstate or foreign 
trade and regulate practices that may be potentially detrimental to 
competition (price discrimination, exclusive dealing contracts, etc.). 
Under the Antitrust Division's Corporate Leniency Program, the first 
company that reports the violation receives immunity from prosecution. 
That type of circumstance does not apply here.
    iii. Existing legal requirements and regulations as models for the 
rule.
    In the DoJ letter of May 23, 2007, DoJ stated that--
     Unlike healthcare providers or financial institutions, 
there is at present no general requirement that contractors alert the 
Government immediately as a matter of routine when fraud is discovered;
     DoJ has been careful not to ask contractors to do anything 
that is not already expected of their counterparts in other industries;
     Our Government's expectations of its contractors has not 
kept pace with the reforms in self-governance in industries such as 
banking, securities, and healthcare. Several respondents all considered 
that for far too long contractors have played by different rules than 
their counterparts in other industries, such as health care providers 
and research grant recipients. A Government agency commented that 
healthcare providers and banks have had such a requirement for many 
years. An agency OIG commented that in the past 15 years there have 
been significant reforms in industries such as banking, securities, and 
healthcare, yet we have not asked the same of Government contractors.
    In the DoJ letter of May 23, 2007, DoJ stated that the requested 
changes are modeled on existing requirements found in other areas of 
corporate compliance such as the Sarbanes-Oxley Act of 2002 and expand 
slightly on the Contractor Standards of Conduct in DFARS 203.7000. DoJ 
also noted that the National Reconnaissance Office (NRO) has begun 
requiring its contractors to disclose contract fraud and other illegal 
activities.
    a. More far-reaching. However, one respondent stated that the 
proposed rule imposes substantially more far-reaching and draconian 
disclosure obligations on Government contractors than those presently 
made applicable to financial institutions by submission of Suspicious 
Activity Reports (12 CFR 21.11). The financial institution has to 
report a crime if the financial institution is an actual or potential 
victim of the criminal activity. Where a contractor is a victim of a 
crime committed by an employee or another person, the employee's 
conduct is not imputed to the contractor. Therefore, the corporation 
does not incur the risk of criminal liability when it reports an 
employee violation and is not incriminating itself.
    According to another respondent, the current laws and regulations 
are not sweeping and burdensome, but are specific and narrowly focused. 
The respondent pointed out that the Anti-Kickback Act and Foreign 
Corrupt Practices Act limit their mandatory disclosure to a very 
limited class of activity. The respondent also pointed out that 
Sarbanes-Oxley contemplates internal reporting mechanisms and review 
mechanisms at the highest levels before any reporting occurs. The other 
respondent also addressed the internal control certification required 
by the Sarbanes-Oxley Act of 2002. Sarbanes-Oxley applies to a 
contractor that is a public company. Section 302 of Sarbanes-Oxley does 
not require that a public company disclose to the Government conduct it 
believes may be a violation of criminal law.
    Response: Many of the public comments reveal a basic 
misunderstanding of the existing mandatory disclosure requirements 
found in the healthcare, banking, and securities areas. Each 
requirement effectively mandates disclosure of fraud as broad as the 
particular regulatory issue being addressed can reach. Beyond that 
limitation, these other requirements are no more limited than the 
proposed rule, particularly with the further changes in the final rule 
with regard to the types of Federal crimes covered.
    In particular, the Councils do not agree with the interpretation of 
12 CFR 21.11. 12 CFR 21.11 requires financial institutions to report 
suspicious activities committed or attempted against the bank or 
involving a transaction or transactions conducted through the bank, 
where the bank was used to facilitate a criminal transaction.
    Even though Section 302 of Sarbanes-Oxley does not require a public 
company to disclose to the Government conduct it believes may be a 
violation of criminal law, there are pre-existing securities laws and 
regulations that require disclosure to the SEC. Sarbanes-Oxley does not 
provide immunity from prosecution for wrong-doing but provides 
protection against third-party liability with regard to a lawsuit by 
the persons accused of wrongdoing.
    b. Conforming the FAR? One respondent stated that if the FAR 
Council is relying on conforming the FAR to regulations applicable to 
other industries as a justification, the Council should state this 
explicitly and provide a detailed analysis of the regulations in other 
areas on which it is relying.
    Response: The Councils did not rely on conforming the FAR to 
regulations applicable to other industries as a justification, but 
merely cited some parallels. The FAR regulations are designed to suit 
the particular circumstances of acquisition.
    c. Particular public need/statutory basis? One respondent stated 
that current disclosure programs are not instructive. The respondent 
also stated that these programs are targeted towards a particular 
public need, and in most cases are the product of legislation that was 
enacted in response to a particular public scandal or important 
national need. In enacting statutory schemes, Congress saw a particular 
need and targeted legislation to address the particular need (Sarbanes-
Oxley, the

[[Page 67071]]

Anti-Kickback Act, the Foreign Corrupt Practices Act, and banking 
laws).
    Several respondents were concerned that the same justification does 
not exist for this proposed rule as the cited statutes and regulations. 
One respondent stated that the Council has not provided a rational 
basis to explain why such a significant change to the FAR is necessary. 
The respondent asserted that the proposed rule could be challenged 
under the Administrative Procedure Act (APA) because the FAR Council 
has not provided a ``rational basis'' to justify the mandatory 
disclosure requirement, nor is there statutory authority behind the FAR 
Council to issue a regulation providing for mandatory disclosure of 
criminal acts. The respondent therefore concluded that the FAR Council 
lacks the authority to issue the regulation (See AFL/CIO v. Kahn, 472 
F. Supp. 99 (D.D.C. 1979), rev'd, 618 F. 2d 784 (D.C.Cir. 1979)). One 
respondent saw this as particularly important in light of DoJ's 
reliance upon the example of other statutorily-mandated disclosure 
programs (Sarbanes-Oxley, Foreign Corrupt Practices Act, etc.) as 
justification for this regulatory initiative. The respondent stated 
that the mandatory disclosure provisions in the proposed rule are 
neither the product of specific findings or legislation, nor any 
perceived critical national need, and thus are not appropriately 
compared to other existing mandatory disclosure programs.
    Response: The DoJ proposed a mandatory disclosure program in order 
to emphasize the critical importance of integrity in contracting. The 
public demands honesty and integrity in corporations with which the 
Government does business. If there is concern that there is not a 
current public need warranting proceeding with this case, the Councils 
cite the public outcry over the overseas exemption in the first 
proposed rule and the recent enactment of the Close the Contractor 
Fraud Loophole Act (Pub. L. 110-252, Title VI, Chapter 1). The Act 
requires exactly what the first rule proposed, except that the overseas 
and commercial item exemptions have been eliminated. However, the rule 
did not require this legislation in order to have the authority to 
proceed in this case. The Councils issue rules under the authority of 
the Office of Federal Procurement Policy Act as well as 40 U.S.C. 
121(c), 10 U.S.C. chapter 137, and 42 U.S.C. 2473(c). The Administrator 
for Federal Procurement Policy may prescribe Governmentwide procurement 
policies to be implemented in the FAR (41 U.S.C. 405). This case was 
opened at the request of OFPP. This case is making clear what was 
already expected. It is not unreasonable or ``capricious'' to require 
contractors doing business with the Government to disclose violations 
of the civil False Claims Act (civil FCA) or a violation of Federal 
criminal law involving fraud, conflict of interest, bribery, or 
gratuity violations found in Title 18 of the United States Code that 
have occurred in connection with the award, performance, or closeout of 
any Government contract performed by the contractor or a subcontract 
thereunder. Existing DoJ guidelines addressing corporate prosecution 
standards, while certainly not providing amnesty, suggest that if a 
company discloses such violations, the prosecution will be of the 
individuals responsible for the violation, not the entire organization.
    d. Empirical support that mandatory disclosure will achieve the 
Councils' objective. One respondent stated that mandating disclosure 
without empirical support to show that it will achieve the Councils' 
objectives will be susceptible to challenge. The APA requires courts to 
strike down rules devoid of factual support. Another respondent also 
cited the APA, and that a rule may be set aside if it is arbitrary or 
capricious (5 U.S.C. 706).
    Response: The Councils point to the testimony from DoJ and various 
OIGs that the experience with the NRO mandatory disclosure clause has 
been positive (see next paragraph). The Councils further cite the 
enactment of the Close the Contractor Fraud Loophole Act (see prior 
section), which now mandates many of these revisions to the FAR.
    e. The NRO requirement. An agency OIG noted that similar 
contractually imposed disclosure requirements have been successfully 
implemented by the NRO. According to DoJ, the NRO reports that this 
requirement has improved its relationships with its contractors and 
enhanced its ability to prevent and detect procurement fraud. Another 
agency OIG stated that adoption of the NRO clause resulted in increased 
and earlier disclosure of wrongdoing and better working relationships 
built upon greater sharing of information and trust. It also led to the 
conclusion that it is more effective for a contractor to mandatorily 
disclose information pursuant to a requirement, than it is for a 
contractor to be in a position of offering up information that it could 
be criticized, or even sued, for providing.
    One respondent, however, stated that the NRO requirement is not an 
appropriate model for all Government contractors because it requires 
disclosure of potential illegal activity related to the conduct of 
intelligence operations in the interest of national security and thus 
is not instructive. In fact, according to another respondent, the 
unique nature of the NRO and its responsibilities are major reasons 
cited as justification for its disclosure program. Similarly, the other 
respondent stated that, while the NRO's mandatory disclosure program 
was not the product of legislation, it was the direct product of an 
obvious and public awareness that we live in a different world after 
September 11, 2001.
    Furthermore, several respondents cited problems with the NRO 
disclosure program. One respondent stated that ``it is far from clear 
at this point whether the NRO mandatory disclosure program is or will 
be productive'', citing anecdotal reports from the contractor community 
suggesting that the program is not as effective as the NRO claims. One 
respondent cited problems experienced by contractors subject to the NRO 
OIG reporting clause, claiming that the NRO OIG has inserted itself in 
the administration of contracts by using the clause as the basis to 
become involved in all aspects of the contractor ethics functions and 
corporate investigations. For example, the respondent stated that the 
OIG has used this clause to investigate, as a Federal offense, matters 
as mundane as employees who have been disciplined for leaving work 
early while reporting they were present. The respondent does not 
believe that OIG agents should be routinely involved in company 
internal ethics functions and contract administration. The respondent 
quoted Mr. Paul Denett, Administrator of the Office of Federal 
Procurement Policy: ``The IG serves a purpose, but it needs to be 
limited to core areas.''
    However, the response from the National Procurement Fraud Task 
Force (NPFTF), signed by the IG of the NRO, stated that the requirement 
for mandatory reporting has worked very well at NRO: The reporting of 
wrongdoing has increased, comes earlier, and has led to a good working 
relationship. NPFTF considers that this model can have a similar impact 
across the Federal Government, and that the situation at NRO is not 
unique.
    Response: Almost all the agency OIGs submitting public comments 
cite the success of the clause initiated by the NRO OIG as a reason for 
supporting this rule for their agency procurements.
    As to limiting the role of the OIG to its core area, the core area 
of the OIG is to investigate fraud, conflict of interest, bribery, and 
gratuity violations. OIG agents will not be routinely involved in 
company internal ethics functions and

[[Page 67072]]

contract administration unless violations are disclosed. The final rule 
has been revised to more closely focus the situations that must be 
disclosed by limiting violations of criminal law to violations 
involving fraud, conflict of interest, bribery, or gratuity violations 
found in Title 18 of the United States Code (see B.3.b.iii.).
    iv. Will mandatory disclosure make reporting easier or better? In 
the DoJ letter of May 23, 2007, DoJ stated that if the FAR were more 
explicit in requiring such notification, it would serve to emphasize 
the critical importance of integrity in contracting. An agency OIG 
stated that the requirement will simplify the contractors' decision on 
whether to disclose suspected violations. Likewise, another agency OIG 
stated that the contractor is in a stronger position when reporting for 
the purpose of complying with a mandatory requirement than if 
voluntarily disclosing information, for which it could be criticized, 
or even sued. Another agency OIG commented that making self-reporting a 
requirement gives the honest contractor employees necessary leverage 
over those who may seek to shield the employer when wrongdoing is 
noticed or suspected.
    On the other hand, some other respondents believed that if 
employees know that everything they report will be passed on to the 
Government, this may result in less reporting up the chain of the 
company rather than more. One respondent saw substantial potential to 
decrease rather than enhance cooperation with company compliance 
efforts.
    The respondent was concerned that the likelihood of severe 
consequences will necessarily change the relationship of the company 
and its employees. Every interview will have the potential of resulting 
in employees being reported. It may be that investigative targets may 
not only be entitled to counsel, but to Miranda warnings, if the 
company is deemed to be acting on behalf of the Government. Further, 
another respondent was concerned that mandatory reporting may violate 
existing contracts with a labor union and may be an unfair labor 
practice if imposed without bargaining, citing American Elec. Power 
Co., 302 NLRB 161(1991). Resistance by the employees can undercut the 
entire compliance program. A respondent also believed that employees 
may be reluctant to come forward if they are aware that the contractor 
will be required to report their co-workers, or report the company 
itself, to the OIG. This respondent cited studies by the framers of the 
USSG who undertook significant research addressing these issues.
    Response: The Councils believe that by mandating disclosure, 
contractor executives and their counsel will be more inclined to make 
the required disclosure to the OIG, as opposed to either not disclosing 
or informally alerting the contracting officer, who is not in a 
position to evaluate the criminal behavior of individual employees. By 
mandating disclosure to the OIG, the rule will add weight to the 
arguments inside a corporation that good business practices in the long 
run favor compliance and disclosure. Nothing in the proposed rule 
requires administration of ``Miranda'' warnings. The rule does not 
place contractors in the role of law enforcement officers. With regard 
to the concerns about labor agreements, contractors can find ways to 
disclose without violating labor union provisions that protect 
individual privacy of workers.
    v. Cooperative atmosphere more effective. According to one 
respondent, voluntary disclosure fosters a cooperative environment and 
rewards contractors that adopt effective internal controls. Another 
respondent considered that it is a key principle to promote self-
governance as the preferred model to ensure compliance. This respondent 
quoted the Packard Commission findings in June 1986 that self-
governance is the most promising mechanism to foster improved contract 
compliance. Self-governance makes the difference between responsibility 
for compliance and a mere facade of compliance. This respondent 
concluded that, based on 20 years of experience, both scholars and 
industry leaders believe that the current system of voluntary 
disclosure encourages companies to develop a stronger culture while 
still affording the Government broad remedies to protect the 
Government's interests. Under mandatory disclosure, contractors may 
focus on the ambiguities of the letter of the rule rather than the 
spirit of mutual commitment. One respondent expressed long standing 
support for and experience with voluntary self-reporting. It is 
concerned that mandatory self-reporting could discourage partnerships 
with the Government. One respondent cited the ``fundamental principle'' 
that contractor compliance programs resulting from internal company 
commitments to ethical behavior are more likely to be effective in 
preventing illegal behavior than programs imposed by ``overbearing 
regulations.''
    Response: The Councils disagree. See ``Is voluntary disclosure 
working?'' at paragraph B.3.a.ii.
    vi. Incentives. Several respondents contended that existing 
Government programs and contractor initiatives offer ample incentives 
for contractors to voluntarily report procurement violations.
     Several respondents pointed out that contractors may 
receive favorable consideration in debarment proceedings if they have 
voluntarily disclosed the conduct in question.
     Several respondents cited the civil FCA, which provides 
contractors with an incentive to report potentially fraudulent 
behavior. Organizations will voluntarily disclose to avoid lengthy and 
costly whistleblower litigation (qui tam actions). According to several 
respondents, voluntary disclosure can undermine a court's jurisdiction 
to entertain future qui tam cases and can mean the difference between 
maximum and reduced penalties.
     Several respondents also addressed the reduced penalties 
under the guidelines of the USSG, adopted in 1991, which are predicated 
on a model of rewarding voluntary reports. Two respondents stated that 
the proposed rule is inconsistent with the favorable treatment of 
voluntary disclosures under the USSG.
     Respondents cited the Deputy Attorney General's January 
20, 2003, memorandum, ``Principles of Federal Prosecution of Business 
Organizations,'' which provides to Federal prosecutors guidance 
governing charging decisions with respect to corporations and 
sentencing. Several respondents also cited Deputy Attorney General Paul 
J. McNulty's memorandum of December 12, 2006, which demonstrated that 
the DoJ considers an organization's voluntary disclosure and 
cooperation in determining whether to bring charges.
    Various respondents were concerned that the proposed rule may 
eliminate the ability of a contractor to claim the benefit of ``timely 
and voluntary disclosure'' to the Government. One respondent 
recommended that, if the rule is finalized, a contractor should not be 
precluded from seeking and receiving leniency because a disclosure is 
made in compliance with the rule. One respondent stated that the 
proposed rule is not more consistent with the USSG, but actually 
contradicts them.
    One respondent stated that the Councils must consider these 
concerns and evaluate the extent to which eliminating incentives to 
voluntary disclosure will affect a contractor's decision to disclose 
underlying behavior. The respondent believed that

[[Page 67073]]

eliminating incentives could cause contractors to adopt a protective 
posture in the face of evidence of potential criminal behavior.
    Another respondent suggested that, instead of mandating compliance 
and ethics programs, the Councils should open a new FAR case to develop 
an incentive-based approach. This respondent was concerned that the 
logic of penalizing contractors for failure to disclose a crime, rather 
than offering incentives, will not work. The disclosure obligation 
applies only if a crime has already occurred. If there is already a 
crime, then the company is already subject to punishment. Failure to 
disclose will only be an aggravating factor. So, if a company fails to 
disclose, it may escape punishment, but if it discloses, it will likely 
still be subject to punishment for the crime committed. Therefore, 
punishment for failure to disclose may not be sufficient incentive to 
disclose.
    Response: There is nothing in this rule that removes any of the 
existing incentives. The incentives in the FAR (FAR 9.406-1(a)) and the 
USSG are not limited to ``voluntary'' disclosures but to 
``disclosures.'' Even if disclosure is ``mandatory,'' incentives will 
still be offered to promote compliance.
b. Vagueness of Rule
    i. ``Reasonable grounds to believe.'' Numerous respondents were 
concerned that the rule does not specify what constitutes ``reasonable 
grounds.'' One respondent stated that ``reasonable grounds'' is subject 
to varying interpretations, and may be viewed as an even lower standard 
than ``probable cause.'' Should the contractor report based on mere 
suspicion or based on evidence that criminal activity has occurred? 
Because of this lack of clarity, several respondents were concerned 
that companies may tie up Government resources with a mountain of 
meaningless legal trivia. Numerous respondents stated that there will 
be substantial over-reporting because contractors may report even 
remotely possible criminal conduct out of an abundance of caution. One 
respondent considered that this will raise company costs through the 
investigation of baseless claims and incidents. Several other 
respondents stated that there will be an enormous amount of time spent 
sorting out the true criminal activity and truly significant problems.
    One respondent suggested that the proposed rule will potentially 
subject an employer to civil actions brought by an employee when the 
reports forwarded by the employer to the Federal Government (because 
conceivably ``reasonable grounds'' existed) ultimately are determined 
to lack merit.
    Response: The Councils have replaced ``reasonable grounds to 
believe'' with ``credible evidence.'' DoJ Criminal Division recommended 
use of this standard after discussions with industry representatives. 
This term indicates a higher standard, implying that the contractor 
will have the opportunity to take some time for preliminary examination 
of the evidence to determine its credibility before deciding to 
disclose to the Government. See also the following discussion of 
``timely disclosure.''
    ii. Timely disclosure.
    There are 3 aspects of timely disclosure that are of concern to the 
respondents:
     To which violations/contracts does timely disclosure 
apply?
     How much time does a contractor have to disclose a 
possible violation after first hearing something about it?
     How do we transition into this rule? How is timeliness 
measured for violations that the contractor may already know about and 
did not disclose prior to becoming subject to this rule?
    Further, in analyzing these issues, there are 3 separate 
requirements for timely disclosure in this rule which may affect the 
response to the above questions:
     The contract clause requirement to disclose (paragraph 
(b)(3)).
     The contract clause requirement for an internal control 
system (paragraph (c)(2)(ii)(F)).
     Failure to timely disclose as a cause for suspension/
debarment regardless of requirement for contract clause or internal 
control system (Subpart 9.4).
    a. To which violations/contracts does timely disclosure apply?
    Various respondents were concerned about whether the rule can apply 
to violations that occurred before the effective date of the rule, the 
date of the bid, or the date the clause is incorporated into the 
contract.
     Effective date of the rule. Numerous respondents 
recommended that the rule be made applicable only to conduct occurring 
on or after the date the rule is effective. The respondents argued that 
there is presently no requirement in the FAR for a contractor to 
disclose to the Government criminal violations committed by its 
employees. The respondents cited case law to support the argument that 
application of the rule to conduct occurring before the rule effective 
date would be impermissible. One respondent stated that the reporting 
requirement should be ``prospective only''. Otherwise this requirement 
may impose an unreasonable burden.
     Date the clause is incorporated. Another respondent 
questions whether the rule is meant to cover past acts, or only acts 
going forward from the date the clause is incorporated into a contract. 
According to one respondent, to punish entities for past acts would 
violate constitutional ex post facto prohibitions.
     Date of the bid. One respondent suggested that the 
violation would have to occur after the date of the bid.
    Several respondents also looked at the end of the period during 
which violations that occur must be reported. One respondent suggested 
that completion of performance would be appropriate.
    DoJ suggested limiting the mandatory disclosure of overpayments or 
criminal violations to matters discovered by the contractor within 
three years after contract completion.
    Response: The first significant point to remember is that in all 
cases the reportable violations are linked to the performance of 
Government contracts. In the case of the contract clause direct 
requirement for contractor disclosure, the reportable violations are 
limited to the contract containing the clause. So the questions raised 
by the respondents about occurrence of violations are not an issue with 
regard to the contract clause disclosure requirement, because 
violations would necessarily occur during award or performance of the 
contract, through contract closeout, which would necessarily be after 
the effective date of the rule and after incorporation of the clause. 
(Note: The clause will be included in solicitations and resultant 
contracts after the effective date of the rule, in accordance with FAR 
1.108(d)).
    However, in the case of internal control systems and suspension/
debarment, the proposed rule states that reportable violations could 
occur in connection with ``any Government contract.'' This could be 
overly broad in two regards--
     Does it apply to violations on the contracts of other 
contractors?
     Does it apply to contracts closed out 20 years ago?
    The Councils have made clear in the final rule that this disclosure 
requirement is limited to contracts awarded to the contractor (or 
subcontracts thereunder). It was not the intent of the proposed rule to 
require contractors to report on violations of other contractors under 
contracts unrelated to their own contracts.
    The Councils do not agree with the respondents who think that 
disclosure under the internal control system or as a potential cause 
for suspension/

[[Page 67074]]

debarment should only apply to conduct occurring after the date the 
rule is effective or the clause is included in the contract, or the 
internal control system is established. The laws against these 
violations were already in place before the rule became effective or 
any of these other occurrences. This rule is not establishing a new 
rule against theft or embezzlement and making it retroactive. The only 
thing that was not in place was the requirement to disclose the 
violation. If violations relating to an ongoing contract occurred prior 
to the effective date of the rule, then the contractor must disclose 
such violations, whether or not the clause is in the contract and 
whether or not an internal control system is in place, because of the 
cause for suspension and debarment in Subpart 9.4.
    However, the Councils agree that this requirement should not 
stretch back indefinitely into the past (e.g., contracts that were 
closed 20 years ago). At that point, relevance with regard to present 
responsibility has diminished, there is less availability of evidence 
to support an investigation, there is more difficulty locating the 
responsible parties (who is the contracting officer?), and there should 
be some reasonable limitation on a contractor's liability after 
contract closeout.
    The Councils considered using contract closeout as the end point 
for the requirement to disclose fraud, but according to the DoJ, often 
contract fraud occurs at the time of closeout, and cutting off the 
obligation to disclose at that point would exempt many of these 
violations from the obligation to disclose. Three years after final 
payment is consistent with most of the contractor record retention 
requirements (see Audit and Records clauses at FAR 52.214-26 and 
52.215-2). Therefore, the Councils concur with the DoJ recommendation 
that the mandatory disclosure of violations should be limited to a 
period of three years after contract completion, using final payment as 
the event to mark contract completion.
    Therefore, the Councils have added the phrase ``Until 3 years after 
final payment on any Government contract awarded to the contractor'' at 
9.406-2(b)(1)(vi) and 9.407-2(a)(8), and has added in the clause at 
paragraph (c)(2)(ii)(F) the statement that ``The disclosure requirement 
for an individual contract continues until at least 3 years after final 
payment on the contract.'' To make the applicability during the close-
out phase of a contract clearer, the Councils have revised the draft 
final rule in all applicable places to refer to ``award, performance, 
or closeout.''
    b. Does ``timely'' allow sufficient time between first learning of 
the allegation and the disclosure?
    One respondent objected that ``timely'' is very broad in scope 
which could permit contracting officers to have inconsistent 
interpretations of what is timely. One respondent questioned whether 
``timely'' means upon first learning of an allegation or only upon 
conducting an adequate internal investigation. The respondent 
recommended that the regulations should include a set period of time 
(i.e., 90 days) for any reporting requirement. Another respondent 
recommended that the regulations might allow 60 days to determine if 
there are reasonable grounds to conclude that the contractor committed 
a crime. The 60 day period would start when a principal of the company 
suspects that a crime might have been committed, but lacks reasonable 
grounds for concluding that a crime has been committed. An agency OIG 
suggested ``timely'' should be replaced with ``within 30 calendar 
days.''
    Another respondent was concerned that when ``timely'' disclosure 
must occur is ambiguous because the timing of a violation is 
troublesome. Contractors often settle cases without any admission of 
fault or liability. The rise in deferred and non-prosecution agreements 
in criminal cases brought by the Government against contractors creates 
confusion regarding disclosure of criminal violations.
    According to many respondents, the proposed rule may require 
premature reporting. One respondent questioned the requirement to 
notify without delay, whenever the contractor becomes ``aware'' of 
violations of Federal criminal law. According to this respondent, the 
rule does not clarify what constitutes ``awareness.'' Several other 
respondents were concerned that the proposed amendment does not appear 
to allow a contractor to complete an internal investigation before 
notifying the OIG and contracting officer. Several respondents 
considered that an internal investigation could be compromised by 
premature reporting. One respondent recommended that the rule should 
allow the contractor the opportunity to comply with its ethics and 
compliance program and conduct an internal investigation prior to 
disclosure to the Government. Contractors should be required to report 
only actual violations of law, not those incidents that have not been 
confirmed as actual violations.
    One respondent pointed out that existing voluntary disclosure 
protocols allow for internal investigation by the reporting parties 
before a disclosure is made. Another respondent stated that under the 
DoD Voluntary Disclosure Program, if the preliminary investigation 
reveals evidence to suggest that disclosure is warranted, contractors 
may disclose information sufficient for preliminary acceptance into the 
DoD Voluntary Disclosure Program, and then have 60 days to complete a 
fuller investigation. This rule provides no guidance on preliminary 
steps afforded to a contractor.
    One respondent also recommended that the contractor be explicitly 
provided with a reasonable period of time to internally investigate a 
potential violation.
    DoJ suggested that the preamble to the final rule should make clear 
that nothing in the rule is intended to preclude a contractor from 
continuing to investigate after making its initial disclosure to the 
Government. DoJ would expect that the OIG or the contracting officer 
will encourage the contractor to complete its internal investigation 
and make full report of its findings.
    In their comment on the second proposed rule, one respondent 
recommends that the preamble should explain that a contractor, with the 
contracting officer's approval, may tailor the ``timely reporting'' 
provision of its internal control system in order to make meaningful 
reports to the contracting officer.
    Response: First, the Councils note that the new statute uses the 
term ``timely'' in setting forth disclosure requirements. The Councils 
considered, and rejected, adding a set period of time, e.g., 30 days, 
to the disclosure requirement. It was decided that doing so would be 
arbitrary and would cause more problems than it would resolve, e.g., 
how to determine when the 30 days begins.
    Further, the Councils believe that using the standard of ``credible 
evidence'' rather than ``reasonable grounds to believe'' will help 
clarify ``timely'' because it implies that the contractor will have the 
opportunity to take some time for preliminary examination of the 
evidence to determine its credibility before deciding to disclose to 
the Government. Until the contractor has determined the evidence to be 
credible, there can be no ``knowing failure to timely disclose.'' This 
does not impose upon the contractor an obligation to carry out a 
complex investigation, but only to take reasonable steps that the 
contractor considers sufficient to determine that the evidence is 
credible.

[[Page 67075]]

    The Councils note that there is no rigidness to our proposed 
requirement to establish an internal control system. The rule just sets 
forth minimum requirements. The contractor can use its own judgment in 
the details of setting up a system that meets the minimum requirements. 
The clause does not require contracting officer approval of this 
system.
    c. Transitioning into the rule. Meaning of ``timely'' when the 
knowledge of credible evidence pre-dates the requirements of this rule. 
One respondent stated that the reporting requirement should be 
``prospective only''. Otherwise this requirement may impose an 
unreasonable burden.
    Response: As just discussed, the disclosure requirement is 
prospective only. Although violations on the current contract might 
have occurred during the pre-award phase and violations on other 
contracts may have already occurred prior to establishment of the 
internal control system or prior to the effective date of the rule, 
timely disclosure of the violation can only be measured from the time 
when the requirement to disclose the violation came into effect, even 
if credible evidence of the violation was previously known to the 
contractor.
    With regard to the contractual disclosure requirement, the timely 
disclosure would be measured from the date of determination of credible 
evidence or the date of contract award, whichever event occurs later.
    With regard to the disclosure requirement of the internal control 
system, it can only become effective upon establishment of the internal 
control system. The violation can have occurred with regard to any 
Government contract which is still open or for which final payment was 
made within the last 3 years, so may predate establishment of the 
internal control system. Therefore, timely disclosure of credible 
evidence as required by the internal control system would be measured 
from the date of determination by the contractor that the evidence is 
credible, or the date of establishment of the internal control system, 
whichever event occurs later.
    With regard to the knowing failure by a principal to timely 
disclose credible evidence of a violation or significant overpayments 
as a cause for suspension or debarment, the violation can have occurred 
with regard to any Government contract, which is still open or for 
which final payment was made within the last 3 years, so may predate 
the effective date of the rule. Therefore, timely disclosure of 
credible evidence as required by the rule as a cause for suspension or 
debarment would be measured from the date of determination by the 
contractor that the evidence is credible, or from the effective date of 
the rule, whichever event occurs later.
    To some extent, the effective date of the rule actually trumps the 
other events, because the failure to timely disclose as a cause for 
suspension/debarment is independent of the inclusion of the contract 
clause in the contract or the establishment of an internal control 
system. At least in those instances where disclosure was not timely in 
regard to effective date of the rule, but was reported as soon as the 
clause was in the contract, or as soon as the control system was in 
place, then it would not be a violation of the contract or a mark 
against the control system. It could still be a cause for suspension or 
debarment, although the Councils consider that suspension or debarment 
would be unlikely, if the contractor came forward as soon as the clause 
or the internal control system was in place (before that, the 
contractor might have been unaware of the requirement to disclose).
    iii. ``Criminal violation in connection with contract award or 
performance.'' Numerous respondents stated that the rule fails to 
specify what constitutes a ``criminal violation'' ``in connection with 
contract award or performance''. Some of these respondents made the 
following comments:
     The broad nature of the phrase ``violation of Federal 
criminal law in connection with contract award or performance'' places 
a heavy burden. The Government is in the best position to provide 
specific guidance to contractors as to the violations that would be 
considered covered by this new requirement. Otherwise, each contractor 
will have to develop its own list and explanations to its employees as 
to what constitutes criminal violations.
     If the FAR Council proceeds with the rule, it should 
provide a specific list of the criminal violations that the contractor 
is required to disclose.
     The self-reporting requirements should be revised to 
provide the specific circumstances under which self-reporting is 
required.
     The provision is vague in regard to the type of ``criminal 
violation'' covered, leaving open application of the rule to non-
procurement related offenses. If an employee commits a criminal 
violation while driving on Federal lands in the course of performing a 
contract, must the traffic violation be reported to the agency OIG? 
Also, the agency OIGs may receive reports about violations of Federal 
tax law or Occupational Safety and Health laws that occur in connection 
with the performance of the contract, over which the OIGs do not have 
jurisdiction. This can result in unnecessary or inappropriate reports.
     The proposed rule does not elaborate on the nexus between 
the perceived criminal conduct and the Federal contract so as to 
trigger the reporting requirement. A contractor's silence could be 
alleged to be a false statement where the employer had ``reason to 
believe'' that one of its employees, agents, or subcontractors had 
violated criminal law in connection with a contract.
     The rule should define more clearly what is reportable and 
when the obligation to report is triggered.
    One Government agency suggested adding ``potential'' to 
``violation.''
    DoJ also suggested tightening the standard for disclosure by adding 
the phrase ``involving fraud, conflict of interest, bribery, or 
gratuity violations found in Title 18 of the United States Code.''
    Response: The Councils have adopted the more specific description 
of criminal law suggested by DoJ as responsive to many of the concerns 
expressed by the respondents.
    As to nexus with the contract, the clause stipulates in paragraph 
52.203-13(b)(3)(i) that the violation should have occurred ``in 
connection with the award, performance, or closeout of this contract, 
or any subcontract thereunder.'' With regard to the internal control 
system disclosure required in paragraph 52.203-13(c)(2)(ii)(F) and the 
cause for debarment or suspension in Subpart 9.4, the violation must be 
in connection with the award, performance, or closeout, of any 
Government contract performed by the contractor, or a subcontract 
thereunder, and the obligation to disclose information lasts until 3 
years after final payment. If there is no connection to a Government 
contract performed by the contractor, or a subcontract thereunder, then 
it need not be disclosed.
    The Councils do not consider it necessary to add ``potential'' to 
``violation'' because that preceding language already is in terms of 
``credible evidence.'' That does not necessarily mean that a violation 
has occurred, but the principals are looking for ``credible evidence'' 
that a violation has occurred. ``Potential violation'' would open it 
even wider and could result in too many unnecessary disclosures.
    iv. Level of employee with knowledge. Several respondents wanted 
the rule to identify the level of contractor employee whose knowledge 
will be imputed to the contractor, such that the contractor has the 
requisite

[[Page 67076]]

knowledge. Absent such identification, consistent with the doctrine of 
respondeat superior applied in Federal criminal law, a contractor may 
be deemed to have requisite knowledge warranting disclosure if any 
employee at any level is aware of conduct which may constitute a 
Federal criminal offense. This could cause a contractor to be accused 
of violating the mandatory disclosure provision before the contractor's 
management becomes aware of the offense and before the appropriate 
steps for disclosure may be undertaken. One respondent stated that it 
is unreasonable to expect all knowledge to be passed up the chain. 
Several respondents recommended revision of the proposed rule to 
require that a contractor principal must have the requisite knowledge 
of a Federal criminal law violation before that knowledge will be 
imputed to a contractor.
    Response: The Councils concur that for debarment and suspension, a 
principal must have the requisite knowledge in order for mandatory 
disclosure to be applicable. See response under the heading 
``Suspension/Debarment'', ``Who has knowledge?'' at paragraph B.5.e.
    c. Disclosure to OIG. One respondent considered that the proposed 
rule would essentially require contractors and subcontractors to become 
fraud detection and reporting entities. Must contractors become experts 
in forensic accounting and private investigation? This respondent 
considered that the proposed rule essentially would ``deputize'' 
contractors and subcontractors as agents of the OIG. One respondent 
also considered that the company is now acting as an agent of the 
Government.
    Is ``the agency OIG'' the OIG for the agency which awarded the 
contract under which the action in question took place? One respondent 
was concerned when contractor is required to disclose to different 
inspectors general because the proposed rule is silent on what actions 
and procedural safeguards are to be implemented in the various offices 
of the Inspectors General. A contractor that deals with a variety of 
different Federal agencies will unreasonably be faced with 
significantly increased risk and uncertainty.
    Several respondents considered that a likely outcome of the 
mandatory reporting to the agency OIG will be to remove from a 
contracting officer or agency the authority or the ability to settle 
and compromise the issues by a disclosure. One industry association 
indicated that member companies report that in their experience, the 
vast majority of potential violations disclosed to a contracting 
officer or other agency official are quickly resolved as an 
administrative matter. Once a matter is referred to the DoD OIG as a 
potential criminal or civil fraud matter, under the Contract Disputes 
Act the contracting officer loses his or her ability to compromise or 
settle the issue. One respondent was also concerned about the impact of 
the proposed rule on the influence and authority of the contracting 
officer. The respondent considered that disclosure to the OIG passes 
the leadership role on any subsequent investigation and review to the 
OIG's office and undercuts the authority and ability of the contracting 
officer to manage contracts.
    One respondent noted that under the DFARS rule, the OIG only needs 
to be notified when appropriate. One respondent considered that 
mandatory notification to the OIG defeats the concept of internal 
audits and correction of possible irregularities. The respondent is 
concerned that, once the OIG is brought into the process, both the 
contracting officer and the contractor/subcontractor lose control of 
the process.
    One respondent was concerned with the ability of the OIG to handle 
an increased level of reports. One respondent stated that their 
experience with the capability of the OIG's offices to deal with 
complicated, sophisticated and/or fact-intensive issues is very mixed 
at best. Current demands have placed substantial strain in the ability 
of the OIG's offices to support investigations, and delays are 
commonplace. ``According to the respondent, `competing demands for 
resources to support overseas investigations and Homeland Security 
defense have drained whatever experienced resources existed'' at the 
agency OIGs.
    An agency OIG suggested replacing ``agency Office of the Inspector 
General'' with ``A President-selected and Senate-approved Inspector 
General or designated Federal entity Inspector General.'' The agency 
OIG stated that this better describes the correct agency to which the 
contractor should report potential violations.
    Response: There is nothing in the proposed rule that ``deputizes'' 
contractors. The Councils have concluded that it is appropriate for 
contractors to send the reports directly to the OIG, with a copy to the 
contracting officer, because it is the OIG that is responsible for 
investigating the disclosure.
    The disclosure would be to the OIG of the agency that awarded the 
subject contract. The Councils have added clarification that if a 
violation relates to more than one Government contract, the Contractor 
may make the disclosure to the agency OIG and Contracting Officer 
responsible for the largest dollar value contract impacted by the 
violation. If the violation relates to an order against a 
Governmentwide acquisition contract, a multi-agency contract, a 
multiple-award schedule contract such as the Federal Supply Schedule, 
or any other procurement instrument intended for use by multiple 
agencies, the contractor shall notify the OIG of the ordering agency 
and the IG of the agency responsible for the basic contract.
    Whether OIGs can handle an increase in the level of reporting 
depends on the expected level of increase. The Councils do not 
anticipate that companies are going to flood the OIG with trivialities, 
as some respondents fear. The Council also notes that the agency OIGs 
were all strongly in favor of this rule.
    The Councils do not agree with the suggestion of one agency IG that 
the rule should specify ``A President-selected and Senate-approved 
Inspector General or designated Federal entity Inspector General.'' 
Although this is probably accurate, the Councils consider it too 
complicated for some contractors to determine. It is the opinion of the 
Councils that, if a contractor submits a report to the wrong OIG, that 
OIG will forward it to the appropriate OIG.
    Throughout the rule, the Councils have used the words ``disclose'' 
and ``disclosure'' for consistency, rather than in some places using 
the word ``notify'' or ``report''.

4. Full Cooperation

    The proposed rule states at paragraph (c)(2)(ii)(G) of FAR 52.203-
XX (now 52.203-13) that a contractor Code of Business Ethics and 
Conduct shall, at a minimum, have an internal control system that 
provides ``full cooperation with any Government agencies responsible 
for audit, investigation, or corrective actions.''
a. Waiver of Privileges/Protections/Rights
    Many respondents expressed concern that compliance with the rules 
requiring disclosure and full cooperation would be interpreted to--
     Require contractors waive an otherwise valid claim of 
attorney-client privilege or protections afforded by the attorney work 
product doctrine, both protecting attorney-client communications; or
     Interfere with an employee's right under the Fifth 
Amendment of the U.S. Constitution covering the right of an

[[Page 67077]]

individual not to be compelled to incriminate itself.
    One respondent recommended addition of strong language to preserve 
privilege protections.
    DoJ and an agency OIG indicated awareness of these concerns in 
their comments and recommended clarification in the final rule. DoJ 
proposed that the final rule state explicitly:
    ``Nothing in this rule is intended to require that a contractor 
waive its attorney-client privilege, or that any officer, director, 
owner, or employee of the contractor, including a sole proprietor, 
waive his or her attorney-client privilege or Fifth Amendment rights.''
    Response: It is doubtful any regulation or contract clause could 
legally compel a contractor or its employees to forfeit these rights. 
However, the Councils have revised the final rule to provide such 
assurance. To address concern that cooperation might be interpreted to 
require disclosure of materials covered by the work product doctrine, 
the Councils have added a definition of ``full cooperation'' at 52.203-
13(a) to make clear that the rule does not mandate disclosure of 
materials covered by the attorney work product doctrine.
    For comparison purposes, it is instructive to refer to the flexible 
approach adopted in the USSG:

    Waiver of attorney-client privilege and of work product 
protections is not a prerequisite to a reduction * * * unless such 
waiver is necessary in order to provide timely and thorough 
disclosure of all pertinent information known to the organization.

    It also is worth pointing out the DoD Voluntary Disclosure Program 
never required waiver as a condition of participation. Contractors in 
that program routinely found ways to report wrongdoing without waiving 
the attorney-client privilege or providing their attorney memoranda 
reflecting their interviews that normally are covered by the work 
product doctrine.
    Any limitation in this rule should not be used as an excuse by a 
contractor to avoid disclosing facts required by this rule. Facts are 
never protected by the attorney-client privilege or work product 
doctrine. Moreover, the Fifth Amendment has no application to 
corporations, so the only sensitive area is mandatory disclosure or 
cooperation by individuals or sole proprietors, which is addressed in 
the clarification.
b. Indemnification of Employees
    Several respondents expressed concern that full cooperation will be 
interpreted as prohibiting a contractor from indemnifying its employees 
or their individual counsel to the extent permitted or required by 
state law or the contractor's charter or bylaws. Several respondents 
expressed concern that the Government may view indemnification of 
contractor employees as not cooperating. One respondent asked if there 
was a difference between ``cooperation'' and ``full cooperation'' and, 
more seriously, whether full cooperation restricted a contractor's 
ability to make counsel available to its employees. Several respondents 
pointed to the district court opinion in U.S. v. Stein, 435 F.Supp. 2d 
330 (SDNY 2006), and 440 F.Supp. 2d 315 (SDNY 2006) that suggests the 
Government viewed KPMG's practice of paying for employees' legal costs 
pursuant to indemnification rules was not ``cooperation'' favored by 
the prosecutors in that case.
    Response: With regard to indemnification of employees for legal 
costs, State law--not Federal--controls. Just as full cooperation 
cannot mean a company forfeits its attorney-client privilege, there is 
no reason to think it means employees forfeit their right to 
indemnification from their employers. On December 12, 2006, DOJ 
addressed this issue in a memorandum sent to all DoJ attorneys by 
Deputy Attorney General Paul McNulty (``McNulty Memorandum''), stating:

    Prosecutors generally should not take into account whether a 
corporation is advancing attorneys' fees to employees or agents 
under investigation and indictment. Many state indemnification 
statutes grant corporations the power to advance the legal fees of 
officers under investigation prior to a formal determination of 
guilt. As a consequence, many corporations enter into contractual 
obligations to advance attorneys' fees through provisions contained 
in their corporate charters, bylaws or employment agreements. 
Therefore, a corporation's compliance with governing state law and 
its contractual obligations cannot be considered a failure to 
cooperate.
c. Requirement to Fire an Employee
    One respondent asked that the rule clarify that cooperation does 
not mean a contractor must fire an employee.
    Response: It is inappropriate for the Government to direct a 
contractor to fire an employee, although the Government may require 
that an employee be removed from performance of the Government 
contract. However, most corporate compliance programs assert that 
violation of law or company policy is grounds for dismissal. Also note 
the internal control system requirements for principals at paragraph 
(c)(2)(ii)(B) of the clause.
d. Ability To Conduct a Thorough and Effective Internal Investigation
    Several respondents expressed concern that cooperation or 
disclosure will be interpreted to interfere with a contractor's ability 
to conduct a thorough and effective internal investigation. Some 
respondents were concerned that a contractor continuing to investigate 
a matter after reporting would be deemed not cooperating. One 
respondent recommended that the rule state explicitly that: ``A 
contractor has a reasonable time to investigate a potential 
investigation * * * and that nothing in the rule prohibits or restricts 
a contractor from conducting an internal investigation.''
    Response: Any interpretation of full cooperation that would suggest 
a limit on contractors conducting internal investigations would be 
clearly at odds with the intent of the rule, which encourages 
compliance program investigations, reporting, and cooperation.
e. Defending a Proceeding or Dispute Arising From or Related to 
Disclosure
    Various respondents expressed concern that full cooperation will be 
interpreted to preclude a contractor from defending itself in a 
proceeding or dispute arising from or related to the disclosure. One 
respondent raised concerns that a rule mandating full cooperation could 
be interpreted as prohibiting a contractor from ``vigorously defending 
its actions.'' Another respondent observed that full cooperation might 
require a contractor to waive its right to appeal the results of an 
audit.
    Response: Nothing in the rule would foreclose a contractor from 
advancing a defense or an ``explanation'' for the alleged fraud or 
corruption arising in a Government contract. This includes being free 
to use any administrative or legal rights available to resolve any 
dispute between the Government and the contractor. The rule is intended 
simply to require the contractor to be forthcoming with its customer, 
the Government, with regard to credible evidence relating to alleged 
fraud or corruption in its Government contracts.
f. Expansion of Audit Rights and Access to Records
    Various respondents asked to what extent full cooperation overrode 
the limits on Government audit rights and access to records 
limitations, giving the Government ``unfettered access'' to individuals 
to conduct interviews, even though the current audit access clauses are 
limited to documents. Expanding on

[[Page 67078]]

that, one respondent also asked if the rule requires contractors to 
give the Government ``full access to their financial and proprietary 
information, beyond that required by existing contract clauses.'' 
Another respondent also observed that the Government may invoke the 
requirement in connection with disputes before the Board of Contract 
Appeals or U.S. Court of Federal Claims. One respondent requested 
clarification that the cooperation requirement applies only to agencies 
affected by the conduct and not the entire Government.
    Response: The proposed rule was not intended to have any 
application or impact on the Government's exercise of its audit and 
access to records rights in the routine contract administration context 
except as the issue arises when a contractor discloses fraud or 
corruption or the Government independently has evidence sufficient to 
open an investigation of fraud and solicit the contractor's 
cooperation. The issue of contractor cooperation in this rule arises 
primarily in the context of Government investigation of contract fraud 
and corruption and any application of this rule in any other context by 
the Government would be clearly overreaching.
g. Inadvertent Failure as Non-Cooperation
    One respondent feared that an ``inadvertent'' failure to provide 
documents in a routine DCAA audit would be deemed non-cooperative.
    Response: The rule has no application to routine DCAA audits.
h. Need for Definition
    Many respondents asked for an expanded definition of ``full 
cooperation'' in order to reduce the potential for misinterpretation of 
the rule, resulting in the concerns addressed in the preceding 
paragraphs.
    Response: Contractors are not expected to block Government auditors 
and investigators' access to information found in documents or through 
its employees in furtherance of a contract fraud or corruption 
investigation.
    Generally speaking, it is also reasonable for investigators and 
prosecutors to expect that compliant contractors will encourage 
employees both to make themselves available and to cooperate with the 
Government investigation.
    That also applies to responding to reasonable Government requests 
for documents. Ignoring or offering little attention to detail in 
responding to auditor or investigator requests or subpoenas for 
documents or information may, in some circumstances, be obstruction of 
justice and, if established, certainly would not be deemed full 
cooperation.
    According to the USSG, cooperation must be both timely and 
thorough:
     To be timely, the cooperation must begin essentially at 
the same time as the organization is officially notified of a criminal 
investigation.
     To be thorough, the cooperation should include the 
disclosure of all pertinent information known by the organization.
--A prime test of whether the organization has disclosed all pertinent 
information is whether the information is sufficient for law 
enforcement personnel to identify--

--The nature and extent of the offense; and
--The individual(s) responsible for the criminal conduct.
--However, the cooperation to be measured is the cooperation of the 
organization itself, not the cooperation of individuals within the 
organization. If, because of the lack of cooperation of particular 
individual(s), neither the organization nor law enforcement personnel 
are able to identify the culpable individual(s) within the organization 
despite the organization's efforts to cooperate fully, the organization 
may still be given credit for full cooperation.

    The DoD Voluntary Disclosure Program described expected cooperation 
in some detail in its standard agreement (the ``XYZ Agreement''), and 
it may be a useful reference in this circumstance where the contractor 
discloses credible evidence of fraud or corruption under this rule. 
However, the detail found there goes significantly beyond the scope of 
this rule and is best addressed on a case-by-case basis.
    The final rule includes a definition that incorporates some of the 
concepts in the USSG and the general principle that cooperation must be 
both timely and thorough. It is intended to make clear that cooperation 
should include all information requested as well as all pertinent 
information known by the contractor necessary to complete the 
investigation, whether the information helps or hurts the contractor. 
Contractors are expected to make their employees available for 
Government investigators and auditors investigating contract fraud and 
corruption and respond in a timely and complete manner to Government 
requests for documents and other information required to conduct an 
investigation of contract fraud and corruption. Responding to concerns 
expressed by the respondents, the Councils have incorporated the 
following definition into the final rule at 52.203-13(a):
    ``Full cooperation''--
    (1) Means disclosure to the Government of the information 
sufficient for law enforcement to identify the nature and extent of the 
offense and the individuals responsible for the conduct. It includes 
providing timely and complete response to Government auditors' and 
investigators' requests for documents and access to employees with 
information;
    (2) Does not foreclose any contractor rights arising in law, the 
FAR, or the terms of the contract. It does not require--
    (i) A contractor to waive its attorney-client privilege or the 
protections afforded by the attorney work product doctrine; or
    (ii) Any officer, director, owner, or employee of the contractor, 
including a sole proprietor, to waive his or her attorney client 
privilege or Fifth Amendment rights; and
    (3) Does not restrict a contractor from--
    (i) Conducting an internal investigation; or
    (ii) Defending a proceeding or dispute arising under the contract 
or related to a potential or disclosed violation.

5. Suspension/Debarment

a. New Cause for Suspension or Debarment
    Various respondents expressed concern that the proposed rule 
establishes failure to timely disclose a violation as a new cause for 
suspension or debarment, rather than suspension or debarment just for 
the underlying violation.
    Response: The requirement for timely disclosure could in some 
circumstances be considered a new cause for suspension or debarment. 
However, the question of timely disclosure will not come up unless the 
Government independently discovers that there has been a significant 
overpayment, a violation of the civil FCA, or a violation of Federal 
criminal law to be disclosed, that the Contractor knew about and 
elected to ignore. It is unlikely that any contractor would be 
suspended or debarred absent the determination that a violation had 
actually occurred. Present responsibility is the ultimate basis of 
suspension or debarment.
b. Unnecessary and Not Good Policy
    Many respondents criticized the additional suspension and debarment 
coverage in the proposed rule as

[[Page 67079]]

unnecessary and redundant to existing regulations that--
     Provide strong incentives for contractors to voluntarily 
disclose criminal behavior;
     Require a prospective contractor to demonstrate a 
satisfactory record of integrity and business ethics; and
     Provide a ``panoply of methods for prosecuting and 
eliminating those companies that fail to abide by the highest ethical 
and legal standards.''
    One respondent stated that the proposed suspension and debarment 
for ``violation of Federal criminal law'' simply repeats much of what 
is contained in FAR 9.406-2 and 9.407-2. Another respondent considered 
the suspension and debarment regulations punitive.
    Response: As addressed in the preceding paragraph, the added causes 
for suspension/debarment add the requirement to timely disclose the 
violation and are not duplicative of the violation itself as a cause 
for suspension/debarment.
    The suspension and debarment policies and standards are not 
punitive. The purpose of suspension and debarment is to ensure that the 
Government does business only with responsible contractors, not to 
punish. This final rule continues to embrace the responsibility 
standard.
c. Mitigating Factors
    Several respondents were concerned whether the proposed rule 
maintains the current scheme of ten mitigating factors at FAR 9.406-
1(a) or renders it meaningless by establishing failure to disclose 
itself as a cause for debarment (thus preventing ``voluntary'' 
disclosure).
    Response: The mitigating factors currently at FAR 9.406-1(a) will 
continue to be used, and a contractor's timely disclosure to the 
Government will continue to be a mitigating factor. As stated in the 
response in paragraph B.3.a.vi. ``Incentives'', above, the incentives 
in the FAR and the USSG are not limited to ``voluntary'' disclosures 
but to ``disclosures.''
    Even if disclosure is ``mandatory,'' incentives will still be 
offered to promote compliance. The Councils do not recommend any 
revision as a result of these comments.
d. Undefined Terms
    Many respondents expressed concern that terms such as ``knowing,'' 
``timely'' ``reasonable grounds to believe,'' and ``overpayment'' are 
undefined and will thus put contractors at risk. One Government 
respondent suggested adding ``knew, should have known, or'' to ``had 
reasonable grounds to believe.''
    Response: See responses under paragraph B.3.b.''Vagueness of 
rule.'' for discussions of ``timely,'' and ``reasonable grounds to 
believe.''
    With regard to the term ``knowing failure to disclose'' the 
``knowing'' refers to the failure to disclose. ``Knowing failure to 
disclose'' was added in the proposed rule to the causes for debarment 
at FAR 9.406-2(b)(1)(vi) and the causes for suspension at FAR 9.407-
2(a)(8). Requiring a ``knowledge'' element to the cause for action 
actually provides more protection for contractors. The Councils do not 
agree with adding ``or should have known.'' The principals are only 
required to disclose what they know. Further, using the standard of 
``credible evidence'' rather than ``reasonable grounds to believe'' 
will help clarify ``knowing'' (See response at ``Vagueness of rule'' at 
paragraph B.3.b.i., ``Reasonable grounds to believe'').
    The term ``overpayment'' is described in a number of FAR clauses 
and provisions and does not require a definition with respect to 
suspension and debarment. For further discussion of overpayments, see 
response at ``Suspension and Debarment'', paragraph B.5.f. ``Limit or 
abandon suspension/debarment for failure to disclose overpayment''.
e. Who has knowledge?
    One respondent stated that a contractor should be suspended or 
debarred for failing to disclose violations of Federal criminal law 
only if a ``principal'' of the company (as defined in the proposed 
contract clause) has knowledge of the crime. Failure to disclose crime 
should not be a basis for suspension or debarment if lower-level 
employees, who are not managers or supervisors, commit a crime and 
conceal the crime from the contractor's supervisory-level personnel.
    Response: Paragraph (a)(2) of the clause at FAR 52.209-5 defines 
``principals'' to mean ``officers; directors; owners; partners; and, 
persons having primary management or supervisory responsibilities 
within a business entity (e.g. , general manager; plant manager; head 
of a subsidiary, division, or business segment, and similar 
positions)''. The Councils agree with the respondent and have revised 
3.1003(a)(2), 9.406-2(b)(1)(vi), and 9.407-2(a)(8) to make disclosure 
mandatory when a principal of the company has knowledge. The Councils 
have also added the definition of a principal at FAR 2.101 because it 
now applies to more than a single FAR part, and revised both 
definitions to be singular rather than plural.
    The Councils note that this definition should be interpreted 
broadly, and could include compliance officers or directors of internal 
audit, as well as other positions of responsibility.
f. Limit or Abandon Suspension/Debarment for Failure To Disclose 
Overpayment
    One respondent stated that the proposed ability to suspend or debar 
for failure to disclose an ``overpayment'' on a Government contract may 
create operational difficulties because contracts are subject to 
reconciliation processes with payments audited and adjusted over time. 
Likewise, another respondent stated that singling out routine contract 
payment issues, which are daily events, with errors on both sides, is 
simply unworkable. The respondent cites a situation where a defense 
contractor did disclose an overpayment to the payment office, only to 
be told that it was wrong, yet was later made the subject of a qui tam 
action. Another respondent likewise objected to making reporting of 
overpayments grounds for suspension or debarment rather than a matter 
of contract administration. The respondent stated that the proposed 
rule does not connect overpayments to the criminal law violations upon 
which the rest of the proposed rule is focused.
    One respondent recommended that the FAR Council should abandon the 
proposed changes that would make failure to disclose an ``overpayment'' 
a new cause for suspension or debarment because a number of current FAR 
clauses already require the contractor to disclose specific types of 
overpayments, e.g. , 52.232-25, 52.232-26, 52.232-27, and 52.212-
4(i)(5). These clauses treat such overpayments as a matter of contract 
administration and do not treat them as a matter of possible fraud and 
a basis for suspension or debarment. In addition, the Part 9 provisions 
should state explicitly that the cause for suspension or debarment is 
for violation of the requirements in FAR 52.232-25, 52.232-26, 52.232-
27, and 52.212-4(i)(5). The respondent noted that the proposed rule did 
not demonstrate that the present FAR provisions requiring the 
disclosure of overpayments are ineffective.
    On the other hand, another respondent stated that contractors 
currently have no obligation to report overpayment.
    One respondent was more specifically concerned that overpayments 
can result from indirect rate variances or similar credits that can 
occur years after

[[Page 67080]]

contract performance and that can put the contractor in an over-billed 
situation. The severe sanctions that could inure to contractors so 
situated seem patently unfair. The respondent suggested either 
excluding rate variances or applying the section only to payments made 
during or immediately following contract performance.
    Another respondent was concerned that this ethics rule creates 
potential inconsistency in the treatment of overpayments with the 
existing regulatory provisions of the FAR, and recommends deletion of 
the issue of ``overpayment'' as a basis for suspension and debarment.
    DoJ suggested some answers to these concerns. DoJ considers that a 
duty to disclose an overpayment is just as important as the disclosure 
of criminal violations, and the requirement to disclose both will save 
the contractor from having to decide whether a criminal violation has 
in fact occurred in the case of an overpayment. However, DoJ concedes 
that a materiality requirement is appropriate to limit the scope of the 
requirement to disclose overpayments.
    Response: The Councils dispute the allegation that ``contractors 
currently have no obligation to report overpayments'' and refers the 
respondent to the payment clauses at FAR 52.232-25, 52.232-26, 52.232-
27, and 52.212-4(i)(5). Although other clauses already require 
reporting of overpayment, this inclusion of the requirement in Subpart 
9.4 to disclose significant overpayments is necessary to make it clear 
that, if a contractor does not meet this condition of the contract, it 
can be subject to suspension or debarment.
    The Councils agree with the suggestion by the DoJ that it is 
appropriate to limit the application of suspension or debarment to 
cases in which the unreported overpayment is significant. This will 
resolve some of the respondents' concerns over routine contract payment 
issues. The Councils have revised the final rule to address only 
significant overpayments, which implies more than just dollar value and 
depends on the circumstances of the overpayment as well as the amount. 
Since contractors are required by the Payment clauses to report and 
return overpayments of any amount, it is within the discretion of the 
suspension and debarment official to determine whether an overpayment 
is significant and whether suspension or debarment would be the 
appropriate outcome for failure to report such overpayment.
    Rate variances do not need to be specifically excluded by the case 
because this issue is already taken care of in Part 32 and the Payment 
clauses. Rate variances are not considered overpayments until the rates 
are determined. The suggestion to apply the section only to payments 
made during or immediately following contract performance would not 
necessarily exempt rate variances, depending on when the rates are 
determined.
    Further, the Councils decided to exclude knowing failure to report 
overpayments that result from contract financing payments, as defined 
in FAR 32.001, as grounds for suspension or debarment. Even though such 
overpayments must be reported and returned under the Payment clauses, 
these ongoing payments that are not the final payment on a contract are 
often based on estimates, and are subject to correction as the contract 
progresses. This rule is aimed at the type of overpayment that the 
contractor knows will result in unjust enrichment, and yet fails to 
disclose it.
    The Councils have ensured that there is no overlap or inconsistency 
between this final rule and the current FAR requirements relating to 
overpayment, as well as the Contract Debt case published as part of 
Federal Acquisition Circular 2005-27 on September 17, 2008 (73 FR 
53997).
g. Blacklisting
    One respondent had a different concern, that the proposed changes 
in Part 42 with regard to past performance would allow ``blacklisting'' 
of contractors through consideration of ``integrity and business 
ethics'' in the past performance evaluation without due process 
protections. The respondent stated that the suspension and debarment 
procedures are the proper means to address responsibility issues.
    Response: A contractor's satisfactory record of integrity and 
business ethics has long been one of the required elements for 
determining that a prospective contractor is responsible (see FAR 
9.104-1(d)). The rules for assessing responsibility at FAR Subpart 9.1 
provide for sufficient standards to ensure that offerors are treated 
fairly. FAR 15.306(b)(1) and (d)(3), and 42.1503(b) give the contractor 
the opportunity to comment on adverse past performance. The Councils do 
not recommend any change as a result of this comment.
h. Amendment of the Civil FCA
    One respondent believed that the proposed cause for suspension/
debarment language effectively amends the civil FCA. The respondent 
objected to changing contractors' obligations regarding overpayments 
without using the legislative procedure.
    Response: The Councils disagree that the rule intended to, or did, 
amend the civil FCA outside the legislative process. The civil FCA 
provides a legal tool to counteract fraudulent billings turned in to 
the Federal Government by encouraging ``whistleblowers'' who are not 
affiliated with the Government to file actions against Federal 
contractors, claiming fraud against the Government. It also provides 
incentives to contractors to self-disclose. This does not preclude the 
Government from imposing an obligation on Federal contractors to 
themselves disclose to the Government if instances of overpayment are 
known to the company principals, and to hold them liable for knowing 
failure to disclose such an overpayment. This rule provides another 
tool to determine present responsibility of Government contractors.
    FAR Subpart 9.4 provides debarment/suspension as a possible 
consequence for conviction of or civil judgment for commission of fraud 
or a variety of criminal offenses, although those statutes may already 
provide criminal or civil penalties for violation thereof. For example, 
the Sherman Act (15 U.S.C. 1-7) provides statutory penalties, including 
fines and imprisonment, for violation of the antitrust provisions of 
the statute. It is not inconsistent with the statute, nor does it 
require legislative amendment to include in the FAR that violation of 
the Federal statutes in submission of an offer is cause for debarment 
or suspension.
i. Technical Corrections
    The Councils moved FAR 3.1002(c) to 3.1003(a)(2), because it 
presents a requirement rather than just policy guidance. In addition, 
the term ``Mandatory'' was removed from the phrase ``Mandatory 
requirements'' at 3.1003, because it is redundant. The title of 
paragraph (a)(1) of FAR 3.1003 has been amplified to indicate that this 
paragraph is describing contractor requirements.

6. Extend to Violation of Civil False Claims Act

a. Support Application to Disclosure of Violations of the Civil FCA
    The Department of Justice, Civil Division, which is responsible for 
the enforcement of the civil FCA, fully supports the extension of the 
proposed rule to require that contractors report violations of the 
civil FCA, 31 U.S.C. 3729 et seq., and to provide that the knowing 
failure to timely disclose such violations may be grounds for

[[Page 67081]]

suspension or debarment. Various respondents, including agency OIGs, 
express support for these provisions.
    Response: Concur.
b. Same Issues as Raised With Regard to Other Mandatory Disclosures
    Numerous respondents suggested that certain of their objections to 
the original proposal to require disclosure of criminal violations and 
to make a knowing failure to timely disclose such violations grounds 
for suspension or debarment, also apply to an expanded requirement that 
contractors disclose civil FCA violations. For example, some commented 
that disclosure should not be required because the conduct constituting 
violation of federal criminal law or the civil FCA is potentially broad 
and subject to varying interpretations by the Government, contractors 
and courts (and by relators in civil qui tam suits); that the 
requirement that violations be ``timely'' disclosed upon ``reasonable 
grounds to believe'' a violation has occurred are subject to varying 
interpretations as to when and under what circumstances a violation 
must be disclosed; that there is no rational basis for the proposed 
rule; that the rule would impose an unreasonable burden on contractors; 
and, that knowing failure to timely disclose should not be cause for 
suspension or debarment.
    Response: These areas of concern common to both criminal and civil 
violations are addressed in other sections of this report. As discussed 
more fully elsewhere, the Councils have replaced the ``reasonable 
grounds to believe'' standard of the proposed rule with a ``credible 
evidence'' standard in the final rule, and to specify that the 
violation must have a nexus to contract award, performance or close-
out, and to clarify that it is the knowledge of the principal that 
triggers the suspension and debarment cause. See responses under 
``Vagueness of rule'' at paragraph B.3.b.i. (Reasonable grounds to 
believe); B.3.b.ii.(Timely disclosure); B.3.b.iii. (Criminal violation 
in connection with contract award or performance); and B.3.b.iv. (Level 
of employee with knowledge).
c. Issues Particular to the Civil FCA
    i. Difficult to determine if violation has occurred. Several 
respondents urged that contractors should not be required to disclose 
violations of the civil FCA or be subject to suspension or debarment 
for a knowing failure to do so on a timely basis because, they suggest, 
the potential misconduct covered by the Act is broad, and the 
application of the statute raises many difficult factual and legal 
issues that the Government, contractors, relators and courts interpret 
in various ways. For example, one respondent argues that the contractor 
and the Government are not always aligned on whether a violation of the 
civil FCA has occurred, and suggests that it is impractical to assume 
that an average contractor employee will know definitively when a 
violation of the civil FCA has occurred. Several respondents observe 
that that there are many difficult legal and factual issues that arise 
in civil FCA matters, such as whether a submission constitutes a 
``claim'', whether a statement is ``false,'' and whether the person 
making the statement or submitting the claim acted with the requisite 
knowledge. Another respondent argues the courts are in conflict over 
what conduct constitutes a violation of the civil FCA. Another 
respondent considers it unfair to require contractors to make civil FCA 
liability determinations given conflicting judicial interpretations of 
the civil FCA and the contractor's inability to access relevant facts. 
This respondent argues that certain Federal appellate courts and the 
United States Supreme Court have read a materiality requirement into 
the civil FCA even though that element is not stated explicitly in the 
text. One respondent cites a split in the circuits regarding whether an 
entity that is subject to complex regulatory requirements can be held 
liable under the civil FCA when the entity bases its conduct on a 
reasonable interpretation of an ambiguous statute or regulation. 
Another respondent states that whereas federal crimes are fairly well-
defined, novel and aggressive interpretations of the civil FCA have 
created an environment in which many claims of breach of a contract 
might be construed as civil FCA violations.
    Based on the premise that violations of the civil FCA are difficult 
to define, several respondents concluded that contractors will be 
subject to suspension and debarment if the contractor misinterprets the 
circumstances and does not report a violation, even if there exists an 
honest disagreement about whether a violation of the civil FCA has 
occurred.
    Response: The Councils do not agree that the requirements of the 
civil FCA cannot be reasonably ascertained and understood by 
contractors, and expects that contractors doing business with the 
Government are taking appropriate steps to ensure their compliance with 
that statute and all other applicable laws. The most recent amendments 
to the statute were made in 1986, and a significant body of case law 
interpreting the statute, and the 1986 amendments in particular, has 
developed in that time period. These cases interpret the various 
elements of a civil FCA violation, including the definition of a claim, 
falsity, knowledge, and damages.
    Although the Councils recognize that some issues concerning the 
proper application of the civil FCA remain unsettled and subject to 
further judicial interpretation, this is not unique to the civil FCA.
    Moreover, the disclosure requirement applies only where the 
contractor has ``credible evidence'' that a violation of the civil FCA 
has occurred. The contractor is subject to suspension and debarment for 
failure to timely disclose the violation only where the contractor does 
so knowingly. Genuine disputes over the proper application of the civil 
FCA may be considered in evaluating whether the contractor knowingly 
failed to disclose a violation of the civil FCA.
    In this regard, the Councils note that the mere filing of a qui tam 
action under the civil FCA is not sufficient to establish a violation 
under the statute, nor does it represent, standing alone, credible 
evidence of a violation. Similarly, the decision by the Government to 
decline intervention in a qui tam action is not dispositive of whether 
the civil FCA has been violated, nor conclusive of whether the 
contractor has credible evidence of a violation of the civil FCA.
    ii. Broad scope of civil FCA. Several respondents suggested that 
requiring contractors to disclose violations of the civil FCA 
significantly expands the situations in which disclosure must be 
considered, and notes that the civil FCA can be violated even in 
situations where the Government suffers no financial loss. One 
respondent states that the civil FCA encompasses an ``almost limitless 
universe of activities.''
    Response: The Councils do not agree that requiring disclosure of 
civil FCA violations will significantly broaden the situations where 
disclosure must be considered. Concerning the suggested breadth of the 
civil FCA, please see response to ``Issues particular to the civil 
FCA'', at paragraph B.6.c.i. ``Difficult to determine if violation has 
occurred''. The first proposed rule required contractors to disclose 
significant overpayments and violations of criminal law in connection 
with a Government contract or subcontract awarded thereunder, and the 
addition of the civil FCA is a natural extension of the rule. When a 
claim or payment comes under review, it often is not known at the 
outset of the investigation whether the matter is an overpayment, or a 
civil or criminal violation. In many cases, the same investigation must 
be done to determine the nature of the

[[Page 67082]]

conduct at issue. The same fraud may be actionable under the civil FCA 
or its criminal analogs, and require proof of the same general 
elements. See, e.g., 18 U.S.C. 287 (criminal False Claims Act); 18 
U.S.C. 1001 (false statements).
    Moreover, the fact that a course of conduct can violate the civil 
FCA even if the Government does not suffer a financial loss does not 
mean that disclosure is not relevant to the contractor's present 
responsibility. For example, the Government may avoid a financial loss 
because a contracting officer alertly catches and declines to pay a 
false or fraudulent claim, or perhaps because the false claim is 
disclosed by the contractor.
    iii. Mitigation in civil FCA for voluntary disclosure. One 
respondent argues that there is no need to make failure to timely 
disclose a civil violation of the civil FCA a basis for suspension and 
debarment because the civil FCA already provides that damages may be 
reduced from trebles to doubles where the contractor discloses a 
violation to the United States. Another respondent suggests that the 
proposed FAR rule would convert these otherwise voluntary disclosures 
into mandatory disclosures, thereby preventing contractors from 
benefiting from the damages reduction provision of the civil FCA. One 
respondent requests that the final rule clarify that any mandatory 
reporting obligation is not intended to and does not prevent a 
contractor from seeking, and the Government from providing, reduced 
damages as a result of a disclosure made in compliance with the new 
contract provision.
    Response: The Councils do not agree that the reduced damages 
available to contractors who disclose violations of the civil FCA in 
accordance with that Act obviates the need for the proposed amendment 
to make a failure to timely disclose a violation the basis for 
suspension or debarment. These provisions address two separate 
Governmental interests. The damages provisions of the civil FCA address 
the Government's ability to recoup its loss as a result of a violation, 
and recognize that timely disclosure is an important means for 
mitigating that loss. Suspension and debarment is concerned with the 
contractor's present responsibility. Timely disclosure of violations of 
the civil FCA is an important indicator of the contractor's present 
responsibility.
    The mitigating provisions of the civil FCA apply to any disclosure 
that meets the requirements set forth in 31 U.S.C. 3729(a)(A). There is 
nothing in the FAR rule that would preclude a contractor from meeting 
the actual requirements of the reduced damages provision of the civil 
FCA. (See response at paragraphs B.3.a.vi. and B.5.c. discussing the 
mitigating factors in the USSG and in the FAR.) In its comments to the 
proposed rule, the Civil Division of DOJ, which enforces the civil FCA 
for the United States, noted that a contractor that meets both the 
disclosure requirements of the FAR and the civil FCA ``would receive 
the dual benefit of qualifying to seek reduced damages under the civil 
FCA and avoiding the potential for suspension and debarment under the 
FAR.''
    iv. Proposed amendments to the civil FCA. Several respondents 
suggest that a contractor making a mandatory disclosure of a violation 
of the federal civil FCA risks prompting a potential relator to file a 
qui tam suit based on the disclosure, and note that the public 
disclosure bar under existing law likely would not bar such a suit. 
These respondents further suggest that this risk is increased if 
proposed amendments to the civil FCA (S.2041 and H.4854) are enacted 
because they would eliminate the public disclosure bar as a 
jurisdictional defense to a qui tam suit.
    Response: The Councils recognize that mandatory disclosure of a 
violation of the civil FCA presents a risk that a qui tam action will 
follow. This risk is not unique for disclosures of civil FCA 
violations; the same risk arises from disclosures of overpayments and 
violations of criminal law. Furthermore, the underlying violation 
itself presents a risk of a qui tam action. Timely disclosure of a 
knowing violation offers the contractor an opportunity to demonstrate 
its present responsibility to avoid suspension or debarment, and to 
obtain a reduction in damages under the civil FCA.
    v. Healthcare and banking. Several respondents disagreed with the 
view expressed by DOJ that the civil FCA reporting requirement imposes 
on Government contractors the same disclosure standards as those 
required of the healthcare and banking industries, and that no law 
requires disclosure of a civil FCA violation.
    Response: See response, in paragraph B.3.a.iii.a. under ``Mandatory 
disclosure to the OIG'', ``More far-reaching''.
    vi. Inherently governmental. One respondent objects that requiring 
contractors to disclose violations of the civil FCA to the Government 
would force contractors to interpret and enforce Federal law, which 
epitomizes an inherently governmental function.
    Response: The Councils disagree that the mandatory disclosure 
provisions result in a transfer of an inherently governmental function 
to contractors. As noted in response B.6.c.i. above, individuals and 
entities contracting with the Government are subject to the civil FCA, 
and the Government expects that its contractors will take appropriate 
steps to ensure their compliance with all applicable laws. Compliance 
necessarily requires that contractors interpret the law as it may apply 
to their own circumstances and conduct, and this obligation is no 
different whether the law is civil or criminal. The Government will 
continue to exercise its independent judgment as to the proper 
interpretation of the civil FCA, to enforce the civil FCA consistent 
with applicable law, and to pursue violations of that law where 
appropriate, irrespective of whether those violations are brought to 
its attention by a contractor's disclosure or otherwise.
    vii. Technical correction. One respondent is concerned that with 
addition of disclosure of violations of the False Claims Act, it is not 
entirely clear whether the limiting clause ``in connection with the 
award or performance of this contract or any subcontract thereunder'' 
applies to reporting both violations of Federal criminal law and 
violations of the civil FCA.
    Response: Concur. The Councils have modified the rule accordingly.

7. Application to Acquisition of Commercial Items

a. Support Application to Acquisition of Commercial Items
    An agency OIG, in commenting on the first proposed rule, believed 
that the responsibility of the contractor to report potential 
violations of criminal law or safety issues related to Government 
contracts or subcontracts should not be based on contract type and 
should not exclude commercial contracts from the reporting requirement.
    In response to the question on the expansion of the second proposed 
rule to apply to commercial items, various respondents, including many 
agency OIGs, support application to contracts for the acquisition of 
commercial items.
    Response: Concur.
b. Do Not Support Application to Acquisition of Commercial Items
    Several respondents state that the proposed rule is inconsistent 
with Public Law 103-355 and FAR Part 12.
    Another respondent is concerned that application of the proposed 
rule to commercial acquisitions will be difficult for educational 
institutions to implement.
    Another respondent states that DoJ fails to show any deference to 
OFPP

[[Page 67083]]

with respect to commercial item policy, asserting without any rationale 
or elaboration that there would be no reason to exclude so-called 
commercial item contracts. This respondent states that the rule cannot 
be applied to commercial items without specific authorization by 
Executive Order or statute.
    One respondent believes that applying Government-unique clauses to 
commercial suppliers will drive them away from the Government 
marketplace. Since this respondent recognizes that this is now required 
by statute, they will continue to seek a repeal of the statute.
    Another respondent recommends against requiring commercial item 
contractors to develop new, Government-only ethics standards that 
result in a company having two standards of conduct, one for Government 
business and one for everything else.
    Response: The disclosure requirements of the new statute 
specifically apply to commercial items. Furthermore, the statute 
includes the words ``pursuant to FAR Case 2007-006 or any follow-on FAR 
case'' which the Councils interpret as covering the inclusion of the 
civil FCA as addressed in the second proposed rule.
c. Application to Commercial Subcontracts
    One respondent questions whether application of the proposed rule 
to the business practices of a commercial vendor that has no direct 
contractual relationship with the Federal Government has any relevance 
to assuring proper stewardship of Federal funds.
    One respondent is concerned that without a more distinct definition 
of ``subcontractor,'' the flowdown obligation may be applied more 
broadly than necessary. The respondent requests additional guidance in 
order to distinguish actual subcontractors from entities that may be 
contracted to provide collateral services to the commercial contractor 
(e.g., service vendors, licensors, corporate subsidiaries).
    Further, another respondent states that revision to FAR Subpart 
44.4 or FAR clauses 52.212-4 or 52.212-5 and clause 52.244-6 would be 
necessary before this requirement can be flowed down to commercial item 
subcontractors, but because the proposed rule has neglected to specify 
changes, there is no proposed authorization to revise those clauses in 
the final rule.
    Response: ``Subcontract'' and ``subcontractor'' are defined at FAR 
44.101. To clarify the meaning in this context, the Councils have 
borrowed from those definitions for use in the text at 3.1001 and in 
the clause at FAR 52.203-13.
    The Councils are authorized to make any revisions to Subpart 44.4, 
Part 12 and Part 44, necessary to conform changes in the final rule, as 
long as changes in the final rule are reasonably foreseeable from 
either the proposed rule text or the discussions in the preamble. This 
constitutes adequate notice to the public. Both the text and preamble 
of the May 16, 2008, proposed rule were specific that the rule would 
apply to subcontracts. The Councils have made appropriate conforming 
changes to 52.212-5 and 52.244-6.
d. Other Concerns
    One respondent questions whether the phrase ``if 52.212-4 appears 
in this contract'' (52.203-13(c)) is another way of saying it is a 
commercial item contract.
    Response: Yes, inclusion of clause 52.212-4 in the prime contract 
would indicate that it is a contract for the acquisition of commercial 
items. However, now that the final rule requires flow down to 
commercial subcontracts, this phrase is inadequate for indicating a 
subcontract for commercial items, and has been revised accordingly.
e. Comments on the First Proposed Rule That Are No Longer Applicable
    One respondent was concerned that the opportunity for substantial 
confusion exists with the rule and recommends additional guidance on 
how the rule impacts companies selling commercial items under FAR Part 
8 acquisitions.
    Another respondent was concerned that the proposed language at 
3.1004 ``awarded under FAR Part 12'' is likely to be misunderstood as 
applying only when the policies of FAR Part 12 are used exclusively and 
the procedures in Parts 13, 14, and 15 are not used.
    Another respondent was concerned that the proposed rule does not 
properly address the exemption for commercial item vendors.
    One respondent was concerned that the proposed rule does not 
justify imposing the new cause for suspension or debarment based on 
failure to disclose a ``violation'', and that will also place 
restrictions on commercial contractors that are not required by law and 
not consistent with the commercial market place.
    Response: These comments are no longer applicable because the 
statute now requires application of most of this rule to commercial 
item contracts.

8. Application to Contracts To Be Performed Outside the United States

a. Support Application Outside the United States
    Four respondents to the first proposed rule questioned the 
exceptions for overseas contacts.
     DoJ disagreed with excluding contracts performed entirely 
outside the United States from the requirements of the rule. The 
respondent indicates that the United States is still party to such 
contracts and potentially a victim when overpayments are made or when 
fraud occurs in connection with the contacts.
     One respondent was concerned that the rule exempts 
contracts performed overseas without providing an explanation as to why 
a basic policy of a code of ethics and business conduct should not 
apply overseas.
     An agency OIG believed that the responsibility of the 
contractor to report potential violations of criminal law or safety 
issues related to Government contracts or subcontracts should not be 
based on contract type and should not exclude contracts performed 
outside the United States from the reporting requirements.
     Another agency OIG believed that it is counterproductive 
to exclude contracts performed entirely outside the United States 
because the United States is still party to such contracts and may be 
victimized when overpayments are made or fraud occurs in connection 
with those contracts. The respondent also argues the contracts require 
greater vigilance because they are performed overseas where U.S. 
resources and remedies are more limited; and that the inclusion would 
reduce the vulnerabilities that often plague overseas programs and 
increase the effectiveness of those programs.
    In response to the proposed expansion overseas in the second 
proposed rule, various respondents, including several agency OIGs, 
support making the requirements of this rule applicable to contracts 
and subcontracts performed outside the United States.
    Response: Concur.
b. Do Not Support Application Outside the United States
    One respondent raised the concern that if any part of the work is 
performed outside the United States, labor and privacy laws in Europe 
would prohibit mandatory reporting by employees.
    Another respondent is concerned that extension of the requirements 
to contracts and subcontracts performed

[[Page 67084]]

outside the U.S. will likely have a significant and negative effect on 
academic institutions' ability to engage international partners. It is 
inappropriate and impractical to expect our international partners to 
do business in the same way as U.S. organizations. Many foreign 
academic institutions are instrumentalities of foreign governments and 
are subject to their own laws and regulations. Without flexibility, it 
will be impossible to pursue the international research and education
    One respondent also believes that it is unreasonable and 
impractical to expect foreign firms to understand and be able to comply 
with the unique procedural requirements the U.S. imposes on its 
contractors. This respondent recognizes that this is now required by 
statute and it will seek a repeal of the statute.
    Response: The disclosure requirements of the new statute 
specifically apply to acquisitions to be performed outside the United 
States. Furthermore, the statute includes the words ``pursuant to FAR 
Case 2007-006 * * * or any follow-on FAR case'' which the Councils 
interpret as covering the inclusion of the civil FCA as addressed in 
the second proposed rule.

9. Other Applicability Issues

a. Educational Institutions
    i. Exempt educational and research institutions. One respondent 
requested that educational and research institutions be granted the 
same exemption afforded small business by making the requirement for a 
formal training and/or awareness program and internal control systems 
inapplicable to such institutions.
    Response: By passing the ``Close the Contractor Fraud Loophole 
Act,'' Congress made clear its preference for fewer, rather than more 
exemptions. The requirements at 3.1002(b) are that the ethics and 
compliance training program be suitable to the size of the entity and 
extent of its involvement in Government contracting. Further, this 
regulation applies only to contracts using appropriated funds, not to 
grants.
    ii. Imposition of procurement requirements on grant recipients. One 
respondent stated that OMB regulation 2 CFR 215.40 forbids agencies to 
impose procurement requirements on grant recipients unless required by 
statute or Executive order or approved by OMB.
    Response: This rule is not imposing any requirements on grant 
recipients. The FAR does not apply to contracts awarded using grant 
money. Federal Government grant recipients who are also Federal 
Government contractors must comply with both the grant regulations and 
the FAR, as applicable.
b. Subcontractors
    Various responses were received on the obligations imposed by this 
rule between contractors and subcontractors and the flow down of this 
rule to subcontractors.
    Response: The Councils note that the same rationale that supports 
the application of the rule to prime contractors supports the 
application to subcontractors. The same reasonable efforts the 
contractor may take to exclude from its organizational structure 
principals whom due diligence would have exposed as engaging in illegal 
acts are the same reasonable efforts the contractor should take in 
selecting its subcontractors. Subcontractors should also use those same 
reasonable efforts in employment and subcontracting efforts.
    i. Obligation to report violations by subcontractors. According to 
several respondents, prime contractors should not be responsible for 
oversight of their subcontractors and should not be subject to 
debarment for failure of a subcontractor to meet the requirement of the 
rule. The respondents were concerned that the rule renders prime 
contractors police for their subcontractors which respondents consider 
unreasonable and burdensome. One respondent was also concerned that 
rule creates a contractual obligation on the part of the contractor to 
ensure that its subcontractors perform as required by the rule. Another 
respondent stated that the rule fails to define the obligation of the 
contractor to police its subcontractors with regard to the required 
compliance program and integrity reporting. It is unclear what degree 
of due diligence the Government expects of the contractor.
    Response: There is no requirement for the contractor to review or 
approve its subcontractors' ethics codes or internal control systems. 
Verification of the existence of such code and program can be part of 
the standard oversight that a contractor exercises over its 
subcontractors. The prime contractor is subject to debarment only if it 
fails to disclose known violations by the subcontractor. Therefore, a 
change to the rule is not necessary.
    ii. Disclosure through the prime contractor. One respondent was 
concerned that the rule mandates that the disclosures go directly to 
the Government and not through the prime contractor. DoJ was concerned 
that some subcontractors may not be comfortable making disclosure 
through the prime contractor and suggested that a mechanism through 
which a subcontractor makes a disclosure be addressed in the final 
rule.
    Response: The clause flow down in paragraph (d)(2) states that in 
altering the clause to identify the appropriate parties, all 
disclosures of violations of the civil FCA or of Federal criminal law 
shall be directed to the agency OIG, with a copy to the contracting 
officer. The clause does not require disclosure through the prime 
contractor.
    iii. Liability for erroneous disclosure. One respondent was 
concerned that the rule creates a potential significant liability for 
the contractor if disclosures concerning subcontractors turn out to be 
in error. The respondent requested the Councils to consider whether 
damages assessed against contractors for erroneous reports would be 
allowable costs. Also, the respondent was concerned that the rule is 
unclear about the disclosure of criminal violations by subcontractors, 
and suggests that the Councils revise the rule to make the disclosure 
requirements for the contractor and the subcontractor parallel.
    Response: The Councils revised the rule to require the contractor 
to disclose credible evidence of a violation of Federal criminal law in 
connection with the contract or any subcontract under the contract. 
This revision provides to the contractor sufficient opportunity to take 
reasonable steps to determine the credibility of any possible 
disclosure prior to disclosing it to the agency Inspector General and 
contracting officer. The potential for erroneous disclosure is 
minimized by requiring the contractor to disclose only credible 
evidence of violations, thereby reducing the contractor's potential 
liability for damages associated with erroneously disclosing alleged 
violations which are not substantiated.
c. Small Businesses (See Also Paragraph 11. ``Regulatory Flexibility 
Act Concerns'', for Comments on Initial Regulatory Flexibility 
Analysis)
    i. Support level of applicability to small businesses. An agency 
OIG supported the application of the basic requirements of the rule to 
small business because the rule avoids imposing unnecessary burdens on 
small businesses by creating expensive paperwork requirements. 
Likewise, another agency OIG considered the exemption for small 
business contractors (from the requirements for a formal internal 
control system) reasonable. Another agency OIG also indicated that 
undesirable results for small business which could have resulted from 
initial drafts of the rule have been mediated by this rule.

[[Page 67085]]

    Response: Concur.
    ii. Overly burdensome on small business: One respondent believed 
that the rule is an overly burdensome and unrealistic policing 
requirement that imposes significant new cost requirements and is 
particularly burdensome for small businesses; effectively precluding 
such businesses from competing for prime contract work or as a high-
tier subcontractor.
     Response: Although the rule may have a significant 
economic impact on a substantial number of small entities with respect 
to the disclosure requirement, the rule is structured to minimize its 
impact on small business concerns by making the requirement for formal 
training programs and internal control systems inapplicable to small 
businesses, and limiting the disclosure requirement of violations of 
Federal criminal law to those violations involving fraud, conflict of 
interest, bribery, or gratuity violations found in Title 18 of the 
United States Code, although the rule did add the reporting of 
violations of the False Claims Act. The Councils do not believe that a 
change to the rule is necessary.
d. Dollar Threshold or Minimum 120 Day Performance Period
    i. Recommend no threshold and no minimum performance period. One 
agency OIG commented on the rule's threshold of $5 million and 120-day 
performance period. The agency OIG believed that the application of the 
rule should not be determined on the basis of the dollar value or the 
period of performance of the contract. The respondent was concerned 
that, at times, contracting officers have awarded smaller dollar value 
contracts or modifications instead of one large dollar contract to 
circumvent various thresholds that trigger requirements. The respondent 
believed that the public and members of Congress have similar 
expectations of all contractors no matter the contract value or type.
    Response: The Close the Contractor Fraud Loophole Act (Pub. L. 110-
252, Section 6103) now defines a covered contract for application of 
this regulation as any contract in an amount greater than $5 million 
and more than 120 days in duration. The Councils also note that, 
regardless of whether the clause is included in the contract, the 
suspension and debarment provisions in Subpart 9.4 apply to all 
contractors, regardless of contract value or duration.
    ii. Applicability of thresholds to Federal Supply Schedule (FSS) 
contracts and Blanket Purchase Agreements (BPA). One respondent 
requests explanation of the applicability of the thresholds to FSS 
contracts. The respondent does not believe that FAR 1.108(c) adequately 
clarifies the issue. Are the thresholds based on each individual order?
    Response: According to FAR 1.108(c), unless otherwise specified, if 
the action establishes a maximum quantity of supplies or services to be 
acquired, the final anticipated dollar value must be the highest final 
priced alternative to the Government, including the dollar value of all 
options. That is, if it is anticipated that the dollar value of orders 
on an FSS contract will exceed $5 million, then this clause is included 
in the basic contract against which orders are placed.
e. Single Government Standard Also Applicable to Grants
    One respondent was concerned that multiple Federal agencies already 
have compliance guidelines and regulations in place, or in development, 
and believes the rule may be inconsistent with other Federal agency 
requirements. The respondent requested that a single Federal 
Government-wide standard be created to foster integrity and honesty 
that applies to both Government contracts and Federal grants.
    Response: The Councils acknowledge the respondent's concern. 
However, this rule establishes a Government-wide standard for 
contractor compliance programs and integrity reporting with respect to 
Government contract awards. Under the rule, all Federal agencies will 
be required to implement the same requirements in the same manner 
consistent with the award of Federal contracts. However, the rule does 
not and is not intended to address contractor compliance programs and 
integrity reporting with respect to agency grant-making procedures. 
Given the legal differences between a grant and a contract that concern 
performance and termination for default, the creation of a single 
Government standard addressing contractor compliance programs and 
integrity reporting is not practical and is outside the scope of the 
rule.

10. Additional Recommendations

a. Defer Final Rule Until
    i. More experience with 2006-007. One respondent suggested that the 
FAR Council evaluate experience with the final rule, before proposing 
changes. The FAR Council should withdraw the proposed rule in favor of 
allowing covered contractors to implement the November 23, 2007, final 
rule.
    ii. Completion of the National Science and Technology Council 
initiative. Several respondents urged the FAR Council to defer further 
action on proposed FAR Case 2007-006 pending completion of the National 
Science and Technology Council (NSTC) initiative to develop compliance 
guidance for recipients of Federal research funding from all agencies 
across the Federal Government.
    iii. Further action on related legislation that would expand the 
scope of the civil FCA. One respondent requests postponement until 
after enactment of pending legislation on the civil FCA.
    iv. Public hearings. One respondent alternatively suggests 
additional public comment in light of the pertinent intervening 
legislation and public hearings.
    Response: The intervening legislation requires implementation of 
this rule in the FAR within 180 days of enactment of Pub. L. 110-252 
(by December 26, 2008). Therefore, the Councils will proceed with this 
rule without delay.
    At the time of publishing the final rule (2006-007), the proposed 
rule (2007-006) under this case had already been published. The 
preamble of the final rule under 2006-007 stated the intent to address 
mandatory disclosure and full cooperation under the follow-on rule.
    It is unknown when the NSTC initiative to develop compliance 
guidance for recipients of Federal research funding from all agencies 
across the Federal Government will be completed. The Councils do not 
agree to delay the FAR rule pending the outcome of this particular 
initiative. Often the regulations for grants use the FAR as a model.
b. Expand Policy and Clause to Cover Overpayments
    DoJ and an agency IG commented that the drafters of the proposed 
rule neglected to incorporate ``knowing failure to timely disclose an 
overpayment'' in the first reference at 3.1002(c).
    Several respondents proposed that the language in the proposed FAR 
clause be expanded to also include instances of overpayment. More 
inclusive language removes any ambiguity (and loopholes) about what 
should be revealed to the Government. By expanding the scope to include 
overpayments, contractors are no longer asked to label (or mislabel) 
their activity as ``criminal''. In the opinion of the respondents, the 
proposed rule does not match the stated objective of encouraging 
Government notification of fraud and overpayments.
    Response: The mandatory reporting of overpayments is addressed in 
the

[[Page 67086]]

Payments clauses. However, to aid in clarity, we have added a cross 
reference at FAR 3.1003 to the Payment clauses and the knowing failure 
to timely disclose significant overpayments as a cause for suspension/
debarment in FAR Subpart 9.4.
c. Create a Contractor Integrity and Business Ethics Information 
Section in FAR Part 42
    One respondent urged the FAR Councils to create a contractor 
integrity and business ethics section in FAR Part 42 that would require 
Government officials to record and maintain integrity and business 
ethics information that can be shared with Government officials. 
Although contractor performance and responsibility are part of FAR 
Subpart 9.1, the respondent requests that distinctive data and 
information be collected on each.
    Another respondent, on the other hand, is very satisfied that the 
rule only proposed one change to the contractor past performance 
information in FAR 42.1501, and properly reinforces the existing 
emphasis on contractor cooperation across a broad range of contract 
administration matters, including cooperation with investigations.
    Response: The proposed rule has added a cross reference in Part 42 
to promote the inclusion of business integrity in past performance. The 
request to collect distinctive data and information on contractor 
responsibility is outside the scope of this rule. The past performance 
databases are controlled by the agencies. (See also response to 
``Suspension/Debarment'', paragraph B.5.g. ``Blacklisting'')
d. Add Safety Issues
    An agency IG suggested that safety issues should be included in the 
mandatory disclosure requirement.
    Response: Adding explicit coverage of safety issues is outside the 
scope of this case.
e. Protection of Contractor Disclosures
    The proposed rule states at 3.1002 (Policy) that contractors should 
have an internal control system that facilitates timely discovery of 
improper conduct in connection with Government contracts. A contractor 
may be suspended or debarred for knowing failure to timely disclose a 
violation of Federal criminal law in connection with the award or 
performance of any Government contract performed by the contractor.
    DoJ suggested that, in order to encourage contractors to submit 
information, the Councils may wish to recommend to agencies that the 
submitted information be maintained confidentially to the extent 
permitted by law and that any disclosure of the information under FOIA 
should only be made after full consideration of institutional, 
commercial, and personal privacy interests that could be implicated by 
such a disclosure. In particular, agencies should be mindful that the 
Trade Secrets Act operates as a prohibition on the discretionary 
disclosure of any information covered by Exemption 4 of the FOIA, 
unless disclosure is otherwise authorized by law.
    Response: The Councils have added the following provision to the 
final rule, similar to the provision employed by the DoD Voluntary 
Disclosure Program (DoD Directive 5106.01, April 23, 2006) in ``XYZ'' 
agreements with contractors pursuant to DoD Voluntary Disclosure 
Program Guidance (IGD 5505.50, CIPO, April 1990) (see http://www.dodig.mil/Inspections/vdprogram.htm): ``The Government, to the 
extent permitted by law and regulation, will safeguard and treat 
information obtained pursuant to the contractor's disclosure as 
confidential where the information has been marked ``confidential'' or 
``proprietary'' by the company. To the extent permitted by law and 
regulation, such information will not be released by the Government to 
the public pursuant to a Freedom of Information Act request, 5 U.S.C. 
section 552, et. seq., without prior notification to the contractor. 
The Government may transfer documents provided by the contractor to any 
department or agency within the Executive Branch if the information 
relates to matters within the organization's jurisdiction.''
    The addition of the above provision will provide appropriate 
assurance to contractors about the Government's protection afforded to 
disclosures.

11. Regulatory Flexibility Act concerns

a. IRFA Does Not Identify a Rational Basis for the Rule
    Several respondents criticized the Initial Regulatory Flexibility 
Analysis (IRFA) as deficient because they believe that it does not 
identify a rational basis for the rule. They claim that there is no 
empirical or anecdotal evidence to explain why the mandatory disclosure 
requirement is required for the proper functioning of the procurement 
system.
    Response: See response to ``Mandatory disclosure to the OIG'', 
``Empirical support that mandatory disclosure will achieve the 
Councils' objective'', at paragraph B.3.a.iii.d.
b. The IRFA Underestimates the Number of Small Businesses Affected and 
the Associated Costs
    Several respondents also considered that the IRFA underestimates 
the number of small businesses affected, as it only describes the 
estimated 28 small businesses which conclude that disclosure is 
required, rather than the larger number which will have to conduct 
internal investigations before concluding that disclosure is not 
required. One respondent pointed out the costs to run a compliance 
program. Another respondent pointed out that the IRFA does not 
ascertain the costs when a company chooses to retain outside counsel to 
investigate, which could range from $1 million to $20 million. The rule 
will cost small businesses over $1 billion a year (calculation--for 
each report there would be 5 internal investigations at a cost of $5 
million per contractor and $2.5 million per subcontractor.)
    Response: First, the IRFA estimated an impact on 45 small 
businesses, not just the 28 covered by the clause.
    Second, an ethical company that learns that an employee may have 
committed a violation of Federal criminal law would not ignore this 
information. A company would normally investigate allegations of 
wrongdoing within the company as a sound business practice. If there 
was clearly no violation, the investigation would be short. Although 
the rule allows contractors time to take reasonable steps to determine 
that evidence of wrongdoing is credible, it does not direct contractors 
to carry out any particular level of internal investigation. The IRFA 
focused on the effort which results from this rule--disclosure to the 
Government--although there are other incentives outside this rule which 
could cause a contractor to voluntarily disclose violations to the 
Government, such as the U.S. Sentencing Guidelines. Although the IRFA 
does not include the cost of the investigation in its calculations, the 
FAR does not require or envision a small business paying millions of 
dollars for an investigation. The respondent's calculated cost 
estimates are not supported or credible.
    The FAR did give relief for the costs of running a compliance 
program by leaving it to the discretion of the small business and 
paragraph (c) of the clause is not mandatory for small businesses.

[[Page 67087]]

c. Imposition of Suspension and Debarment Will Disproportionately 
Damage Small Businesses
    One respondent stated that small businesses do not have the 
resources that large businesses do. They do not have the resources to 
institute compliance programs. They are more likely to be caught in the 
suspension and debarment process. They lack the leverage to negotiate 
agreements in lieu of debarment. Therefore, the rule's reliance on 
suspension and debarment as an enforcement mechanism will 
disproportionately damage small businesses.
    Response: The Councils agree that small businesses often have fewer 
resources than other than small business. Nonetheless, the Councils 
cannot give further flexibility here. The Councils have already 
eliminated the requirement for the internal control system for small 
businesses. The Councils cannot establish a different suspension or 
debarment standard for small businesses.
d. Estimate of Small Businesses That Would Disclose if No Mandatory 
Requirement
    One respondent quoted the IRFA as estimating that, in the absence 
of the proposed disclosure requirement, 1 percent of small business 
contractors that are aware of a violation would voluntarily report it. 
This suggests, according to the respondent, that the FAR Council 
believes that mandatory disclosure would lead to a 100-fold increase in 
the number of reported violations. The respondent states that there is 
no support for this estimate and no rational basis to support a claim 
that this disclosure requirement is needed for the effective 
functioning of the procurement system.
    Response: The respondent has drawn an unwarranted conclusion about 
the estimated impact of mandatory disclosure. The estimated 1% 
disclosure rate in the IRFA is for small businesses that do not have 
the clause in their contract (i.e., small dollar value or short 
performance period). There was no estimate in the IRFA about what 
percentage of this population would disclose if the clause were 
included. Further, any estimates about this segment of the population 
cannot be extrapolated to a conclusion about the effect of mandatory 
disclosure requirements on higher dollar value, noncommercial contracts 
or contracts with large businesses.
e. Recordkeeping Requirements
    One respondent objected that the IRFA did not provide a full 
discussion of the projected recordkeeping and compliance requirements. 
Good business sense will require a contractor to develop and keep more 
records for the purpose of documenting its investigation.
    Response: The Councils agree that recordkeeping would be wise, but 
the rule does not require recordkeeping beyond the recordkeeping that 
would be part of the contractor's normal business practices. Under 5 
U.S.C. 601, the term ``recordkeeping requirement'' is defined as a 
requirement imposed by an agency on persons to maintain specified 
records.
f. Duplication, Overlap, or Conflict
    Several respondents criticized the statement in the IRFA that the 
rule does not duplicate, overlap, or conflict with any other Federal 
rules. The respondents state that the IRFA--
     Ignored the obvious interrelationship with the civil 
Federal civil FCA and its qui tam provisions;
     Did not address the inconsistency between the proposed 
rule and the Federal Sentencing Guidelines; and
     Did not address that the rule is inconsistent with a 
voluntary disclosure being a mitigation consideration in the FAR 
debarment and suspension proceedings and under the civil FCA because 
disclosure would be mandatory rather than voluntary.
    Response: Under 5 U.S.C. 601, ``rule'' is defined as meaning ``any 
rule for which the agency publishes a general notice of proposed 
rulemaking pursuant to section 553(b) of this title or any other law * 
* * ''. Codified laws are not a rule. The Sentencing Guidelines are, 
strictly speaking, also not a rule. However, the Councils disagree that 
this rule is duplicative of the civil FCA. Any inadvertent 
inconsistency with the Guidelines has been considered in formulating 
this final rule.
    Regarding mitigation and voluntary disclosure, see ``Mandatory 
disclosure to the OIG'', ``Incentives'' at paragraph B.3.a.vi.

12. Paperwork Reduction Act (PRA)

a. Burden Underestimated
    One respondent stated that the Councils' Paperwork Reduction Act 
analysis is inadequate. The estimates are so conservative as to be 
unrealistic. If it only takes 20 hours to conduct pre-disclosure review 
and draft a corresponding report, why does it take the Government a 
year to decide whether to intervene in a traditional qui tam case? The 
respondent points out that ``burden'' includes all aspects of the 
reporting process, including the separation of reportable events from 
non-reportable events.
    Another respondent also considers the estimated burden of 3 hours 
per report woefully inadequate, considering the time needed by 
respondents to investigate and determine whether a civil FCA violation 
or criminal violation occurred.
    Response: Burden includes estimated hours only for those actions 
which a company would not undertake in the normal course of business. 
The Government does not direct companies to investigate. In the normal 
course of business, a company that is concerned about ethical behavior 
will take reasonable steps to determine the credibility of allegations 
of misconduct within the firm. It is left to the discretion of the 
company what these reasonable steps may entail. The Government has 
added the requirement to disclose to the Government when credible 
evidence of misconduct is obtained, which would not necessarily 
otherwise occur. The estimated hours in the regulatory flexibility 
analysis and the paperwork burden act analysis are to cover the hours 
required for preparing and reviewing the disclosure to the Government 
when credible evidence has been obtained. The estimated hours must also 
be viewed as an average between the hours that a simple disclosure by a 
very small business might require and the much higher numbers that 
might be required for a very complex disclosure by a major corporation. 
However, upon further discussion with subject matter experts, the 
Councils have revised the estimated hours to 60 hours per response, 
considering particularly the hours that would be required for review 
within the company, prior to release to the Government.
b. Recordkeeping and Other Compliance Requirements
    One respondent stated that the projected recordkeeping and 
compliance requirements are far more burdensome than reflected in the 
IRFA. The contractor must keep and maintain extensive records any time 
it investigates allegations or suspicions of violations. Even if a 
company determines that disclosure is not required, the contractor must 
keep records of its decision-making process in order to defend against 
possible future accusations of failure to disclose.
    Another respondent states that time is required for 1400 covered 
contractors to establish systems for complying with this regulation.

[[Page 67088]]

    Response: See the response in previous section on Regulatory 
Flexibility Analysis (B.11.).
c. Data and Methodology Should Be Made Part of the Rulemaking Record
    Response: The public can request copies of the supporting 
statements.

13. Executive Order 12866

a. Significant Rule
    A number of respondents are concerned that this rule is a 
significant rule in accordance with E.O. 12866 section 3.(f). One 
respondent is concerned that, by extending the rule to cover commercial 
acquisitions and overseas contracts, a review requirement as a ``major 
rule'' or a significant rule under section 3.(f)(1) may have been 
unintentionally triggered. Another respondent believes that the rule 
should have a cost-benefit analysis.
    One respondent states that the addition of violations of the civil 
FCA as a ground for mandatory disclosure is sufficient standing alone 
to trigger review under Section 6(b) of E.O. 12866.
    Another respondent submits that this is a significant regulatory 
action because it will, among other things, adversely affect in a 
material way a sector of the economy (Government contractors).
    Several respondents also state that the second proposed rule raises 
important legal and policy issues, another grounds for the Office of 
Information and Regulatory Affairs (OIRA) to declare a rule significant 
under E.O. 12866, under section 3.(f)(4).
    One respondent suggests that it was a Freudian slip when the FR 
notice for the first proposed rule stated that the first proposed rule 
was a significant regulatory action and therefore was not subject to 
review.
    Response: The first proposed rule was declared to be a significant 
rule by OIRA. The typographical error was in the second half of the 
sentence, not the first. The rule was subject to review under the 
Executive order and was so reviewed. OIRA did not declare the second 
proposed rule to be a significant rule.
    All rules are sent through the Office of Information and Regulatory 
Affairs for determination as to whether the rule is significant. OMB's 
Office of Information and Regulatory Affairs has determined this is a 
significant rule, and not a major rule.
b. Violates E.O. 12866
    One respondent states that the proposed rule violates the E.O. 
12866 requirement that rules be ``consistent, sensible, and 
understandable'' and that agencies promulgate only such regulations as 
are required by law, are necessary to interpret the law, or are made 
necessary by compelling public need. This respondent submits that just 
because DoJ wants to make its job easier is not sufficient grounds for 
rulemaking.
    Response: This rule is required by law and by compelling public 
need. The Councils have made every effort to make the draft final rule 
consistent, sensible, and understandable.
    This is a significant regulatory action and, therefore, was subject 
to review under Section 6(b) of Executive Order 12866, Regulatory 
Planning and Review, dated September 30, 1993. This rule is not a major 
rule under 5 U.S.C. 804.

C. Regulatory Flexibility Act

    The Regulatory Flexibility Act, 5 U.S.C. 601, et seq., applies to 
this final rule. The Councils prepared a Final Regulatory Flexibility 
Analysis (FRFA), and it is summarized as follows:

    1. Statement of the need for, and objectives of, the rule.
    This rule amends the Federal Acquisition Regulation to require 
Government contractors to--
     Establish and maintain specific internal controls to 
detect and prevent improper conduct in connection with the award or 
performance of any Government contract or subcontract; and
     Notify without delay the agency Office of the Inspector 
General, with a copy to the contracting officer, whenever, in 
connection with the award, performance, or closeout of a Government 
contract awarded to the contractor or a subcontract awarded 
thereunder, the contractor has credible evidence of a violation of 
Federal criminal law involving fraud, conflict of interest, bribery, 
or gratuity violations found in 18 U.S.C. or a violation of the 
civil False Claims Act.
    This case is in response to a request to the Office of Federal 
Procurement Policy from the Department of Justice and Public Law 
110-252. Based on the requirements of Pub. L. 110-252, the rule was 
expanded to include the clause 52.203-13 in contracts performed 
overseas and contracts for the acquisition of commercial items.
    The objective of the rule is to emphasize the critical 
importance of integrity in contracting and reduce the occurrence of 
improper or criminal conduct in connection with the award and 
performance of Federal contracts and subcontracts.
    2. Summary of the significant issues raised by the public 
comments in response to the initial regulatory flexibility analysis, 
a summary of the assessment of the agency of such issues, and a 
statement of any changes made in the proposed rule as a result of 
such comments.
    a. IRFA does not identify a rational basis for the rule. Several 
respondents criticized the Initial Regulatory Flexibility Analysis 
(IRFA) as deficient because they believe that it does not identify a 
rational basis for the rule. They claim that there is no empirical 
or anecdotal evidence to explain why the mandatory disclosure 
requirement is required for the proper functioning of the 
procurement system.
    Response: DoJ and various OIGs provided testimony that the 
experience with the National Reconnaissance Organization mandatory 
disclosure clause has been positive. Further, enactment of the Close 
the Contractor Fraud Loophole Act (Pub. L. 110-252, Sec VI, Chapter 
1) now mandates many of these revisions to the FAR.
    b. The IRFA underestimates the number of small businesses 
affected and the associated costs. Some respondents considered that 
the IRFA underestimates the number of small businesses affected, as 
it only describes the estimated 28 small businesses which conclude 
that disclosure is required, rather than the larger number which 
will have to conduct internal investigations before concluding that 
disclosure is not required. Respondents pointed out the costs to run 
a compliance program and that the IRFA does not ascertain the costs 
when a company chooses to retain outside counsel to investigate, 
which could range from $1 million to $20 million. The rule will cost 
small businesses over $1 billion a year (calculation--for each 
report there would be 5 internal investigations at a cost of $5 
million per contractor and $2.5 million per subcontractor).
    Response: First, the IRFA estimated an impact on 45 small 
businesses, not just the 28 covered by the clause. Further, an 
ethical company that finds out an employee may have committed a 
violation of Federal criminal law would not ignore this. A company 
would normally follow up allegations of wrongdoing within the 
company as a sound business practice. If there was clearly no 
violation, the investigation would be short. Although the rule 
allows contractors time to take reasonable steps to determine that 
evidence of wrongdoing is credible, it does not direct contractors 
to carry out any particular level of internal investigation. The 
IRFA focused on the effort which results from this rule--reporting 
to the Government. Although there are other incentives outside this 
rule which could cause a contractor to voluntarily disclose 
violations to the Government, such as the U.S. Sentencing 
Guidelines. Although the IRFA does not include the cost of the 
investigation in its calculations, the FAR does not require or 
envision a small business paying millions of dollars for an 
investigation. The respondent's calculated cost estimates are not 
supported or credible.
    The FAR did give relief for the costs of running a compliance 
program by leaving it to the discretion of the small business; 
paragraph (c) of the clause is not mandatory for small businesses.
    c. Imposition of suspension and debarment will 
disproportionately damage small businesses. A respondent stated that 
small businesses don't have the resources that large businesses do. 
They do not have the resources to institute compliance programs. 
They are more likely to be caught in the suspension and debarment 
process. They lack the leverage to negotiate agreements in

[[Page 67089]]

lieu of debarment. Therefore, the rule's reliance on suspension and 
debarment as an enforcement mechanism will disproportionately damage 
small businesses.
    Response: The Councils agree that small businesses have fewer 
resources than other than small businesses. Nonetheless, the 
Councils cannot give further flexibility here. The Councils have 
already eliminated the requirement for the internal control system 
for small businesses. The Councils cannot establish a different 
suspension or debarment standard for small businesses.
    d. Estimate of small businesses that would report if no 
mandatory requirement. One respondent quoted the IRFA as estimating 
that, in the absence of the proposed disclosure requirement, 1% of 
small business contractors that are aware of a violation would 
voluntarily report it. This suggests, according to the respondent, 
that the FAR Council believes that mandatory disclosure would lead 
to a 100 fold increase in the number of reported violations. The 
respondent states that there is no support for this estimate.
    Response: The respondent has drawn an unwarranted conclusion 
about the estimated impact of mandatory disclosure. The estimated 1% 
disclosure rate in the IRFA is for small businesses that do not have 
the clause in their contract (i.e., small dollar value or short 
performance period). There was no estimate in the IRFA about what 
percentage of this population would report if the clause were 
included. Further, any estimates about this segment of the 
population cannot be extrapolated to a conclusion about the effect 
of mandatory disclosure requirements on higher dollar value 
contracts of duration more that 120 days or contracts with large 
businesses. The number of small businesses affected cannot be known 
exactly because there is no data at this time on disclosures that 
will result from this rule, but the numbers represent the best 
estimate of subject matter experts in the Government.
    e. Recordkeeping requirements. One respondent objected that the 
IRFA did not provide a full discussion of the projected 
recordkeeping and compliance requirements. Good business sense will 
require a contractor to develop and keep more records for the 
purpose of documenting its investigation.
    Response: Although recordkeeping would be wise, the rule does 
not require it. Under 5 U.S.C. 601, the term ``recordkeeping 
requirement'' is defined as a requirement imposed by an agency on 
persons to maintain specified records.
    f. Duplication, overlap, or conflict. Several respondents 
criticized the statement in the IRFA that the rule does not 
duplicate, overlap, or conflict with any other Federal rules. The 
respondents state that the IRFA ignores the obvious 
interrelationship with the Federal False Claims Act and its qui tam 
provisions and it did not address the inconsistency between the 
proposed rule and the Federal Sentencing Guidelines. The rule is 
inconsistent with a voluntary disclosure being a mitigation 
consideration in the FAR debarment and suspension proceedings and 
under the False Claims Act because disclosure would be mandatory 
rather than voluntary.
    Response: Under 5 U.S.C. 601, ``rule'' is defined as meaning any 
rule for which the agency publishes a general notice of proposed 
rulemaking pursuant to section 553(b) of this title. Codified laws 
are not a rule. The Sentencing Guidelines are, strictly speaking, 
also not a rule. However, the Councils disagree that this rule is 
duplicative of the False Claims Act and any inadvertent 
inconsistency with the Guidelines has been considered in formulating 
this final rule. The FAR, the U.S. Sentencing Guidelines, and the 
civil False Claims Act consider any self-disclosure to constitute a 
mitigating circumstance, whether voluntary or mandatory.
    3. Description and estimate of the number of small entities to 
which the rule will apply.
    The rule imposes a clause in contracts that exceed $5 million 
and a performance period greater than 120 days. Based on FY 2006 
data collected from the Federal Procurement Data System, the 
Councils estimate that this clause will apply to 2700 prime 
contractors per year, of which 1050 companies are small business 
concerns.
    The clause also flows down to subcontracts that exceed $5 
million, and we estimate that approximately 1050 additional small 
business concerns will meet these conditions. We calculate the 
number of small business concerns that will be required by the 
clause to report violations of Federal criminal law with regard to a 
Government contract or subcontracts as follows:
    1050 prime contractors + 1050 subcontractors = 2100 x 4% = 84.
    In addition, although there is no clause required, all 
contractors will be on notice that they may be suspended or debarred 
for failure to report known violations of Federal criminal law with 
regard to a Government contract or subcontract. In FY 2006 there 
were 144,854 small business concerns listed in FPDS-NG with unique 
DUNS numbers. We estimate that of the listed small business 
concerns, approximately 116,000 (80%) will receive contracts in a 
given fiscal year. Government small business experts guess that at 
least twice that number of small businesses (232,000) will receive 
subcontracts. However, the only small business concerns impacted by 
this cause for suspension or debarment are those that are aware of 
violation of Federal criminal law with regard to their Government 
contracts or subcontracts. Subtracting out those contracts and 
subcontracts covered by the clause (1050 each), we estimate this 
number as follows: (114,950 + 230,950 = 345,900 x 1% = 3,459). We 
estimate a lower percentage than used for contracts and subcontracts 
that contain the clause, because these are lower dollar contracts 
and subcontracts, including commercial contracts, and there may be 
less visibility into violations of Federal criminal law. Because 
there is no contract clause, we estimate that only 1% of those 
contractors/subcontractors that are aware of a violation of Federal 
criminal law in regard to the contract or subcontract will 
voluntarily report such violation to the contracting officer (3459 x 
1% = 34). The estimated number of small businesses in the FRFA (119) 
has increased from the IRFA (45) because of the applicability of the 
clause to commercial contracts and contracts to be performed outside 
the United States and because the disclosure requirement now applies 
to violations of the civil False Claims Act as well as violations of 
Federal criminal law.
    4. Description of projected reporting, recordkeeping, and other 
compliance requirements of the rule, including an estimate of the 
classes of small entities which will be subject to the requirement 
and the type of professional skills necessary for preparation of the 
report or record.
    The rule requires contractors to report to the agency office of 
the inspector general, with a copy to the contracting officer, 
violations of Federal criminal law in connection with the award or 
performance of any Government contract or subcontract for contracts 
that exceed $5 million with a contract performance period greater 
than 120 days, and the same criteria for flow down to subcontracts. 
Such a report would probably be prepared by company management, and 
would probably involve legal assistance to prepare and careful 
review at several levels. There are no recordkeeping requirements in 
the rule.
    5. Description of the steps the agency has taken to minimize the 
significant economic impact on small entities consistent with the 
state objectives of applicable statute, including a statement of the 
factual, policy, and legal reasons for selecting the alternative 
adopted in the final rule and why each one of the other significant 
alternatives to the rule considered by the agency which affect the 
impact on small entities was rejected.
    The Councils adopted the following alternatives in order to 
minimize the impact on small business concerns:
     The final rule requires small businesses to ``make a 
copy of the code available'' to each employee (rather than ``provide 
a copy''). The Councils rejected the addition of a requirement that 
small businesses must specifically make each employee aware of the 
duties and obligations under the code.
     The requirement for formal training programs and 
internal control systems is inapplicable to small business concerns. 
Large businesses are still required to have an ongoing business 
ethics and conduct awareness and compliance program
     Disclosure of violations of criminal law is limited to 
violations of Federal criminal law involving fraud, conflict of 
interest, bribery, or gratuity violations found in 18 U.S.C., rather 
than any violation of criminal law.
     The violations that must be disclosed do not include 
violations under the contracts of other contractors.
     The period of occurrence of violations that must be 
disclosed is limited to 3 years after contract closeout, rather than 
extending indefinitely.
    The Councils could not exclude small businesses that provide 
commercial items, because Pub. L. 110-252 requires application to 
contracts for the acquisition of commercial items.
    The Councils decided to require disclosure of violations of 
civil False Claims Act (from both large and small businesses), as 
requested by the Department of Justice,

[[Page 67090]]

because to achieve the objectives of this rule, it is crucial to 
deal with responsible contractors, whether large or small. It is not 
necessarily evident at the beginning of an investigation whether an 
incident is simply an overpayment, a civil false claim, or a 
criminal violation. There is no rational reason to exclude civil 
false claims from the mandatory disclosure requirement.

    Interested parties may obtain a copy of the FRFA from the FAR 
Secretariat. The FAR Secretariat has submitted a copy of the FRFA to 
the Chief Counsel for Advocacy of the Small Business Administration.

D. Paperwork Reduction Act

    The Paperwork Reduction Act (44 U.S.C. Chapter 35) applies because 
the final rule contains an information collection requirement (ICR). 
The clause at 52.203-13 requires the Contractor to disclose ``credible 
evidence of a violation'' of Federal criminal law or a violation of the 
False Claims Act, involving fraud, conflict of interest, bribery, or 
gratuity violations found in Title 18 of the United States Code. We 
received one comment from the public on this disclosure requirement. 
Based on the comment that the Government's estimated burden of 3 hours 
per response was inadequate, the Councils have revised the estimated 
burden hours to 60 hours per response. This change particularly 
considers the hours that would be required for review of the collection 
within a company, prior to release to the Government. Based on the 
revised estimated burden of 60 hours per response, the annual reporting 
burden is revised as follows:

Respondents:............................................             284
Responses per respondent:                                            x 1
                                                         ---------------
Total annual responses:.................................             284
Preparation hours per response:.........................            x 60
                                                         ---------------
Total response burden hours:............................          17,040
Averages wages ($75 + 32.85% OH):.......................          x $100
                                                         ---------------
Estimated cost to the Public:...........................      $1,704,000
 

    Accordingly, the FAR Secretariat has forwarded a request for 
approval of a new information collection requirement concerning 9000-
00XX to the Office of Management and Budget under 44 U.S.C. 3501, et 
seq.

List of Subjects in 48 CFR Parts 2, 3, 9, 42 and 52

    Government procurement.

Al Matera,
Director, Office of Acquisition Policy.

0
Therefore, DoD, GSA, and NASA amend 48 CFR parts 2, 3, 9, 42 and 52 as 
set forth below:
0
1. The authority citation for 48 CFR parts 2, 3, 9, 42 and 52 continues 
to read as follows:

    Authority: 40 U.S.C. 121(c); 10 U.S.C. chapter 137; and 42 
U.S.C. 2473(c).

PART 2--DEFINITIONS OF WORDS AND TERMS

0
2. Amend section 2.101 in paragraph (b)(2) by adding, in alphabetical 
order, the definition ``Principal'' to read as follows:


2.101  Definitions.

* * * * *
    (b) * * *
    (2) * * *
    Principal means an officer, director, owner, partner, or a person 
having primary management or supervisory responsibilities within a 
business entity (e.g., general manager; plant manager; head of a 
subsidiary, division, or business segment; and similar positions).
* * * * *

PART 3--IMPROPER BUSINESS PRACTICES AND PERSONAL CONFLICTS OF 
INTEREST

0
3. Revise section 3.1001 to read as follows:


3.1001  Definitions.

    As used in this subpart--
    Subcontract means any contract entered into by a subcontractor to 
furnish supplies or services for performance of a prime contract or a 
subcontract.
    Subcontractor means any supplier, distributor, vendor, or firm that 
furnished supplies or services to or for a prime contractor or another 
subcontractor.
    United States means the 50 States, the District of Columbia, and 
outlying areas.

0
4. Amend section 3.1003 by revising the section heading and paragraph 
(a); redesignating paragraph (b) as paragraph (c), and adding a new 
paragraph (b) to read as follows:


3.1003  Requirements.

    (a) Contractor requirements. (1) Although the policy at 3.1002 
applies as guidance to all Government contractors, the contractual 
requirements set forth in the clauses at 52.203-13, Contractor Code of 
Business Ethics and Conduct, and 52.203-14, Display of Hotline 
Poster(s), are mandatory if the contracts meet the conditions specified 
in the clause prescriptions at 3.1004.
    (2) Whether or not the clause at 52.203-13 is applicable, a 
contractor may be suspended and/or debarred for knowing failure by a 
principal to timely disclose to the Government, in connection with the 
award, performance, or closeout of a Government contract performed by 
the contractor or a subcontract awarded thereunder, credible evidence 
of a violation of Federal criminal law involving fraud, conflict of 
interest, bribery, or gratuity violations found in Title 18 of the 
United States Code or a violation of the civil False Claims Act. 
Knowing failure to timely disclose credible evidence of any of the 
above violations remains a cause for suspension and/or debarment until 
3 years after final payment on a contract (see 9.406-2(b)(1)(vi) and 
9.407-2(a)(8)).
    (3) The Payment clauses at FAR 52.212-4(i)(5), 52.232-25(d), 
52.232-26(c), and 52.232-27(l) require that, if the contractor becomes 
aware that the Government has overpaid on a contract financing or 
invoice payment, the contractor shall remit the overpayment amount to 
the Government. A contractor may be suspended and/or debarred for 
knowing failure by a principal to timely disclose credible evidence of 
a significant overpayment, other than overpayments resulting from 
contract financing payments as defined in 32.001 (see 9.406-2(b)(1)(vi) 
and 9.407-2(a)(8)).
    (b) Notification of possible contractor violation. If the 
contracting officer is notified of possible contractor violation of 
Federal criminal law involving fraud, conflict of interest, bribery, or 
gratuity violations found in Title 18 U.S.C.; or a violation of the 
civil False Claims Act, the contracting officer shall--
    (1) Coordinate the matter with the agency Office of the Inspector 
General; or
    (2) Take action in accordance with agency procedures.
* * * * *

0
5. Amend section 3.1004 by removing the introductory text and revising 
the introductory text of paragraph (b)(1) to read as follows:


3.1004  Contract clauses.

* * * * *
    (b)(1) Unless the contract is for the acquisition of a commercial 
item or will be performed entirely outside the United States, insert 
the clause at FAR

[[Page 67091]]

52.203-14, Display of Hotline Poster(s), if--
* * * * *

PART 9--CONTRACTOR QUALIFICATIONS

0
6. Amend section 9.104-1 by revising paragraph (d) to read as follows:


9.104-1  General standards.

* * * * *
    (d) Have a satisfactory record of integrity and business ethics 
(for example, see Subpart 42.15).
* * * * *

0
7. Amend section 9.406-2 by revising the introductory text of paragraph 
(b)(1) and adding paragraph (b)(1)(vi) to read as follows:


9.406-2  Causes for debarment.

    (b)(1) A contractor, based upon a preponderance of the evidence, 
for any of the following--
* * * * *
    (vi) Knowing failure by a principal, until 3 years after final 
payment on any Government contract awarded to the contractor, to timely 
disclose to the Government, in connection with the award, performance, 
or closeout of the contract or a subcontract thereunder, credible 
evidence of--
    (A) Violation of Federal criminal law involving fraud, conflict of 
interest, bribery, or gratuity violations found in Title 18 of the 
United States Code;
    (B) Violation of the civil False Claims Act (31 U.S.C. 3729-3733); 
or
    (C) Significant overpayment(s) on the contract, other than 
overpayments resulting from contract financing payments as defined in 
32.001.
* * * * *

0
8. Revise section 9.407-2 by redesignating paragraph (a)(8) as 
paragraph (a)(9) and adding a new paragraph (a)(8); to read as follows:


9.407-2  Causes for suspension.

    (a) * * *
    (8) Knowing failure by a principal, until 3 years after final 
payment on any Government contract awarded to the contractor, to timely 
disclose to the Government, in connection with the award, performance, 
or closeout of the contract or a subcontract thereunder, credible 
evidence of--
    (i) Violation of Federal criminal law involving fraud, conflict of 
interest, bribery, or gratuity violations found in Title 18 of the 
United States Code;
    (ii) Violation of the civil False Claims Act (31 U.S.C. 3729-3733); 
or
    (iii) Significant overpayment(s) on the contract, other than 
overpayments resulting from contract financing payments as defined in 
32.001; or
* * * * *

PART 42--CONTRACT ADMINISTRATION AND AUDIT SERVICES

0
9. Amend section 42.1501 by revising the last sentence to read as 
follows:


42.1501  General.

     * * * It includes, for example, the contractor's record of 
conforming to contract requirements and to standards of good 
workmanship; the contractor's record of forecasting and controlling 
costs; the contractor's adherence to contract schedules, including the 
administrative aspects of performance; the contractor's history of 
reasonable and cooperative behavior and commitment to customer 
satisfaction; the contractor's record of integrity and business ethics, 
and generally, the contractor's business-like concern for the interest 
of the customer.

PART 52--SOLICITATION PROVISIONS AND CONTRACT CLAUSES

0
10. Amend section 52.203-13 by--
0
a. Revising the date of clause;
0
b. Revising paragraph (a);
0
c. Revising paragraphs (b)(1)(i), (b)(1)(ii), (b)(2) and adding 
paragraph (b)(3); and
0
d. Revising paragraphs (c) and (d).
    The revised text reads as follows:


52.203-13  Contractor Code of Business Ethics and Conduct.

* * * * *

Contractor Code of Business Ethics and Conduct

(Dec 2008)
    (a) Definitions. As used in this clause--
    Agent means any individual, including a director, an officer, an 
employee, or an independent Contractor, authorized to act on behalf 
of the organization.
    Full cooperation--(1) Means disclosure to the Government of the 
information sufficient for law enforcement to identify the nature 
and extent of the offense and the individuals responsible for the 
conduct. It includes providing timely and complete response to 
Government auditors' and investigators' request for documents and 
access to employees with information;
    (2) Does not foreclose any Contractor rights arising in law, the 
FAR, or the terms of the contract. It does not require--
    (i) A Contractor to waive its attorney-client privilege or the 
protections afforded by the attorney work product doctrine; or
    (ii) Any officer, director, owner, or employee of the 
Contractor, including a sole proprietor, to waive his or her 
attorney client privilege or Fifth Amendment rights; and
    (3) Does not restrict a Contractor from--
    (i) Conducting an internal investigation; or
    (ii) Defending a proceeding or dispute arising under the 
contract or related to a potential or disclosed violation.
    Principal means an officer, director, owner, partner, or a 
person having primary management or supervisory responsibilities 
within a business entity (e.g., general manager; plant manager; head 
of a subsidiary, division, or business segment; and similar 
positions).
    Subcontract means any contract entered into by a subcontractor 
to furnish supplies or services for performance of a prime contract 
or a subcontract.
    Subcontractor means any supplier, distributor, vendor, or firm 
that furnished supplies or services to or for a prime contractor or 
another subcontractor.
    United States means the 50 States, the District of Columbia, and 
outlying areas.
    (b) * * *
    (1) * * *
    (i) Have a written code of business ethics and conduct;
    (ii) Make a copy of the code available to each employee engaged 
in performance of the contract.
    (2) The Contractor shall--
    (i) Exercise due diligence to prevent and detect criminal 
conduct; and
    (ii) Otherwise promote an organizational culture that encourages 
ethical conduct and a commitment to compliance with the law.
    (3)(i) The Contractor shall timely disclose, in writing, to the 
agency Office of the Inspector General (OIG), with a copy to the 
Contracting Officer, whenever, in connection with the award, 
performance, or closeout of this contract or any subcontract 
thereunder, the Contractor has credible evidence that a principal, 
employee, agent, or subcontractor of the Contractor has committed--
    (A) A violation of Federal criminal law involving fraud, 
conflict of interest, bribery, or gratuity violations found in Title 
18 of the United States Code; or
    (B) A violation of the civil False Claims Act (31 U.S.C. 3729-
3733).
    (ii) The Government, to the extent permitted by law and 
regulation, will safeguard and treat information obtained pursuant 
to the Contractor's disclosure as confidential where the information 
has been marked ``confidential'' or ``proprietary'' by the company. 
To the extent permitted by law and regulation, such information will 
not be released by the Government to the public pursuant to a 
Freedom of Information Act request, 5 U.S.C. Section 552, without 
prior notification to the Contractor. The Government may transfer 
documents provided by the Contractor to any department or agency 
within the Executive Branch if the information relates to matters 
within the organization's jurisdiction.
    (iii) If the violation relates to an order against a 
Governmentwide acquisition contract, a multi-agency contract, a 
multiple-award schedule contract such as the Federal Supply 
Schedule, or any other procurement instrument intended for use by 
multiple agencies, the Contractor shall notify the OIG of the 
ordering agency and the IG of the agency responsible for the basic 
contract.
    (c) Business ethics awareness and compliance program and 
internal control

[[Page 67092]]

system. This paragraph (c) does not apply if the Contractor has 
represented itself as a small business concern pursuant to the award 
of this contract or if this contract is for the acquisition of a 
commercial item as defined at FAR 2.101. The Contractor shall 
establish the following within 90 days after contract award, unless 
the Contracting Officer establishes a longer time period:
    (1) An ongoing business ethics awareness and compliance program.
    (i) This program shall include reasonable steps to communicate 
periodically and in a practical manner the Contractor's standards 
and procedures and other aspects of the Contractor's business ethics 
awareness and compliance program and internal control system, by 
conducting effective training programs and otherwise disseminating 
information appropriate to an individual's respective roles and 
responsibilities.
    (ii) The training conducted under this program shall be provided 
to the Contractor's principals and employees, and as appropriate, 
the Contractor's agents and subcontractors.
    (2) An internal control system.
    (i) The Contractor's internal control system shall--
    (A) Establish standards and procedures to facilitate timely 
discovery of improper conduct in connection with Government 
contracts; and
    (B) Ensure corrective measures are promptly instituted and 
carried out.
    (ii) At a minimum, the Contractor's internal control system 
shall provide for the following:
    (A) Assignment of responsibility at a sufficiently high level 
and adequate resources to ensure effectiveness of the business 
ethics awareness and compliance program and internal control system.
    (B) Reasonable efforts not to include an individual as a 
principal, whom due diligence would have exposed as having engaged 
in conduct that is in conflict with the Contractor's code of 
business ethics and conduct.
    (C) Periodic reviews of company business practices, procedures, 
policies, and internal controls for compliance with the Contractor's 
code of business ethics and conduct and the special requirements of 
Government contracting, including--
    (1) Monitoring and auditing to detect criminal conduct;
    (2) Periodic evaluation of the effectiveness of the business 
ethics awareness and compliance program and internal control system, 
especially if criminal conduct has been detected; and
    (3) Periodic assessment of the risk of criminal conduct, with 
appropriate steps to design, implement, or modify the business 
ethics awareness and compliance program and the internal control 
system as necessary to reduce the risk of criminal conduct 
identified through this process.
    (D) An internal reporting mechanism, such as a hotline, which 
allows for anonymity or confidentiality, by which employees may 
report suspected instances of improper conduct, and instructions 
that encourage employees to make such reports.
    (E) Disciplinary action for improper conduct or for failing to 
take reasonable steps to prevent or detect improper conduct.
    (F) Timely disclosure, in writing, to the agency OIG, with a 
copy to the Contracting Officer, whenever, in connection with the 
award, performance, or closeout of any Government contract performed 
by the Contractor or a subcontractor thereunder, the Contractor has 
credible evidence that a principal, employee, agent, or 
subcontractor of the Contractor has committed a violation of Federal 
criminal law involving fraud, conflict of interest, bribery, or 
gratuity violations found in Title 18 U.S.C. or a violation of the 
civil False Claims Act (31 U.S.C. 3729-3733).
    (1) If a violation relates to more than one Government contract, 
the Contractor may make the disclosure to the agency OIG and 
Contracting Officer responsible for the largest dollar value 
contract impacted by the violation.
    (2) If the violation relates to an order against a 
Governmentwide acquisition contract, a multi-agency contract, a 
multiple-award schedule contract such as the Federal Supply 
Schedule, or any other procurement instrument intended for use by 
multiple agencies, the contractor shall notify the OIG of the 
ordering agency and the IG of the agency responsible for the basic 
contract, and the respective agencies' contracting officers.
    (3) The disclosure requirement for an individual contract 
continues until at least 3 years after final payment on the 
contract.
    (4) The Government will safeguard such disclosures in accordance 
with paragraph (b)(3)(ii) of this clause.
    (G) Full cooperation with any Government agencies responsible 
for audits, investigations, or corrective actions.
    (d) Subcontracts. (1) The Contractor shall include the substance 
of this clause, including this paragraph (d), in subcontracts that 
have a value in excess of $5,000,000 and a performance period of 
more than 120 days.
    (2) In altering this clause to identify the appropriate parties, 
all disclosures of violation of the civil False Claims Act or of 
Federal criminal law shall be directed to the agency Office of the 
Inspector General, with a copy to the Contracting Officer.

(End of clause)


0
11. Amend section 52.209-5 by revising the date of clause; and 
paragraph (a)(2) to read as follows:


52.209-5  Certification Regarding Responsibility Matters.

* * * * *

Certification Regarding Responsibility Matters

(Dec 2008)
* * * * *
    (a) * * *
    (2) Principal, for the purposes of this certification, means an 
officer, director, owner, partner, or a person having primary 
management or supervisory responsibilities within a business entity 
(e.g., general manager; plant manager; head of a subsidiary, 
division, or business segment; and similar positions).
* * * * *

0
12. Amend section 52.212-5 by--
0
a. Revising the date of the clause;
0
b. Redesignating paragraphs (b)(2) through (b)(40) as (b)(3) through 
(b)(41), respectively, and adding a new paragraph (b)(2);
0
c. Removing from paragraph (e)(1) ``paragraphs (i) through (vii)'' and 
adding ``paragraphs (e)(1)(i) through (xi)'' in its place; and.
0
d. Redesignating paragraphs (e)(1)(i) through (e)(1)(x) as paragraphs 
(e)(1)(ii) through (e)(1)(xi), respectively, and adding a new paragraph 
(e)(1)(i).
    The added and revised text reads as follows:


52.212-5  Contract Terms and Conditions Required To Implement Statutes 
or Executive Orders--Commercial Items.

* * * * *

Contract Terms and Conditions Required To Implement Statutes or 
Executive Orders--Commercial Items

(Dec 2008)
* * * * *
    (b) * * *
    (2) 52.203-13, Contractor Code of Business Ethics and Conduct 
(DEC 2008)(Pub. L. 110-252, Title VI, Chapter 1 (41 U.S.C. 251 
note)).
* * * * *
    (e) * * *
    (1) * * *
    (i) 52.203-13, Contractor Code of Business Ethics and Conduct 
(DEC 2008) (Pub. L. 110-252, Title VI, Chapter 1 (41 U.S.C. 251 
note)).
* * * * *


52.213-4  [Amended]

0
13. Amend section 52.213-4 by--
0
a. Revising the date of the clause to read (DEC 2008); and
0
b. Removing from paragraph (a)(2)(vi) ``(MAR 2007)'' and adding ``(DEC 
2008)'' in its place.


0
14. Amend section 52.244-6 by--
0
a. Revising the date of the clause;
0
b. Redesignating paragraphs (c)(1)(i) through (c)(1)(vi) as paragraphs 
(c)(1)(ii) through (c)(1)(vii), respectively, and adding a new 
paragraph (c)(1)(i).
    The added and revised text reads as follows:


52.244-6  Subcontracts for Commercial Items.

* * * * *

Subcontracts for Commercial Items

(Dec 2008)
* * * * *
    (c)(1) * * *

[[Page 67093]]

    (i) 52.203-13, Contractor Code of Business Ethics and Conduct 
(DEC 2008) (Pub. L. 110-252, Title VI, Chapter 1 (41 U.S.C. 251 
note).
* * * * *

 [FR Doc. E8-26953 Filed 11-10-08; 8:45 am]
BILLING CODE 6820-EP-P