Reproduced with permission from Federal Contracts Report, Vol. 90 (Dec. 9, 2008) p. 443.

Copyright 2008 by The Bureau of National Affairs, Inc. (800-372-1033) <http://www.bna.com>

INFORMATION CONCERNING THE NEW MANDATORY DISCLOSURE RULES The new FAR mandatory disclosure/ethics and compliance rule goes into effect December 12, 2008, ushering in a new paradigm for the public-private relationship that government contractors enjoy with their federal customers. (FAR Case 2007-006, Contractor Business Ethics Compliance Program and Disclosure Requirements, can be found at 73 Fed. Reg. 67,064 (Nov. 12, 2008).) As government regulators and law enforcement officials assume a more prominent role in contract administration through expanded oversight, questions abound as to how those officials will implement the new rule and discharge their duties in light of the mandatory disclosure requirements. Recent industry outreach meetings with government officials who either helped write the new rule or will be responsible for implementing it have yet to provide consistent guidance on how contractors should expect the rule to be enforced. Consistent guidance or no, the fact remains that as Dec. 12 approaches, all government contractors must take appropriate steps to place themselves in a position to comply with the new requirements on day one. Given the present uncertainty about exactly how the various agency inspectors general and suspension /debarment officials will pursue their new authorities, caution is the word of the day for contractors, that will be best served to err on the side of conservative interpretations of their new obligations. As the new requirements roll out in near real-time, contractors must focus on two primary compliance objectives: (1) satisfying new mandatory disclosure requirements, including possible catchup reporting obligations; and (2) establishing effective internal control processes to promote prospective compliance. Several considerations for each objective are discussed below. Preparing for Mandatory Disclosure Because the new FAR rule demands disclosures of violations or overpayments related to current contracts, or prior contracts for which final payment was received within the last three years, the first step for each contractor should be to compile an inventory of all past and current contracts that fall within the reporting scope. This will provide the contractor with an essential baseline for reporting obligations, as well as guide the contractor in its look back process to determine whether past events require disclosure. Similarly, in light of the three-year look-back period, final payment now has new significance, and contractors should diligently pursue final payment and contract closeout promptly once contract performance ends. Delaying that process may subject a contractor to a longer-than-necessary disclosure period. Because a contractor's reporting obligation is triggered by the knowledge of principals, the contractor must take appropriate steps to identify who could be deemed a principal. The final rule defines principal to mean an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager, plant manager, head of a subsidiary, division, or business segment; and similar positions). The preamble to the rule indicates that principal should be construed broadly, and may include compliance officers or directors of internal audits, as well as other positions of responsibility. After identifying these individuals, the contractor should consider providing them a written explanation of the new disclosure obligations and the

scope of activities that trigger them, designating a central data gathering point, and having each principal provide any information regarding potential violations or overpayments or, alternatively, a signed statement that they are aware of none. Similar ongoing periodic statements by principals also will assist the contractor in prospective compliance. For contractors that already have had in place during the look-back period robust internal controls and investigating/reporting mechanisms, such statements by principals may not be necessary. Likewise, going forward the implementation of such controls and mechanisms may obviate the need for such statements. In addition to beating the bushes for prior undisclosed violations or overpayments, each contractor should also review its history of any disclosures it may already have made to the government on contracts within the reportable time frame. For contractors with covered contracts in excess of $5 million and 120 days, FAR clause 52.203-13 may impose an obligation to refresh previous disclosures to the cognizant agency inspector general, if the disclosure was previously made to another government official, like the cognizant contracting officer. FAR clause 52.203-13 specifically requires disclosures related to a covered contract to be made to the proper inspector general (with a copy to the contracting officer). Thus, for contractors required to maintain internal controls under FAR 52.203-13(c) (i.e. all companies with covered contracts except small businesses and commercial item contractors), it appears that every disclosure may need to be made to the appropriate inspector general. A thorough catalogue of prior disclosures can prepare a contractor to make single omnibus refresher disclosures to a cognizant inspector general, where possible and if necessary. Contractors also will require adequate internal procedures to capture, process, investigate, and assess possible violations from a wide variety of sources to determine whether there is credible evidence triggering a reporting obligation. A key to any such procedures, depending on the size and culture of the contractor, may be centralization. Channeling internal reporting of possible violations to a central person or office with responsibility for coordinating investigations and disclosures may reduce the risk that known violations go unreported and ensure consistency in approach. Such centralized coordination may be especially difficult for large companies or those with a diverse management structure (such as consulting firms with a partnership-like structure), but it may help prevent possible violations known only to dispersed principals from going unreported and will ensure consistency in investigations and disclosure practices. Thus, one of the challenges that contractors are likely to face is ensuring that employees and principals are trained to report possible violations through the proper channels to ensure that consistent procedures and evaluation criteria are applied. Not only may these individuals be illequipped to determine on their own whether there is credible evidence of a violation, but they may also be unlikely to employ reliable procedures to make such a determination. One option is for contractors to designate a senior officer of the company as the internal point of contact with responsibility for coordinating and overseeing internal investigations and disclosure decision-making processes. For companies that already have a dedicated compliance officer, that person could also handle this task. In smaller companies, this role could be fulfilled by another corporate officer who performs multiple roles. In addition to consolidating the decisionmaking process, centralization could help ensure that a contractor consistently follows best practices for conducting and documenting

internal investigations and credible evidence determinations. Given the ambiguous credible evidence reporting standard, contractors may wish to consider establishing policies to document their disclosure or non-disclosure determinations. One interpretation of the rule is that credible evidence is to be determined from the contractor's perspective, and the mandatory reporting obligation is triggered by what the contractor reasonably deems to be credible evidence, not what a prosecutor or relator might deem to be credible evidence. Nevertheless, there is a risk that a contractor may deem evidence not sufficiently credible to merit mandatory disclosure, only to have that determination called into question in a later suspension/debarment proceeding, particularly if there is subsequent qui tam activity or other criminal prosecution or civil litigation. Thorough, contemporaneous documentation of a contractor's internal investigations and credible evidence determinations could provide necessary justification of the adequacy and reasonableness of the contractor's process and decision-making in the glow of hindsight. Nevertheless, contractors should recognize the ambiguity surrounding the credible evidence standard, as well as tension between it and the adequate evidence standard that suspension officials rely on to determine whether there is sufficient need to suspend a contractor. See FAR 9.407-1(b)(1) (Suspension is a serious action to be imposed on the basis of adequate evidence .). This could place a contractor that decides not to disclose a potential violation in a vulnerable position where it must justify or defend its decision not to report on the grounds that the contractor did not believe the results of its investigation constituted credible evidence. Accordingly, contractors should err on the side of caution and when in doubt consider disclosure, at least initially until the scope of the new requirements becomes better understood through experience. Contractors will likely benefit from the early involvement of in-house or outside legal counsel in these internal investigation and deliberation processes. Although the facts uncovered by any attorney-driven investigation are not privileged, attorney-client communications and attorney work-product privileges are preserved notwithstanding the mandatory disclosure and full cooperation requirements in FAR 52.203-13(c). Whether counsel is involved the process or not, however, all documentation prepared in connection with investigations and credible evidence determinations should be prepared with an eye toward possible subsequent disclosure. Inspectors general of the National Aeronautics and Space Administration, General Services Administration, and Defense Department are trying to implement standard electronic forms for disclosures via the internet. See, e.g., http://oig.gsa.gov/integritycover.htm. A contractor should ensure that any written disclosure bears proper restrictive legends that prevent public dissemination of the submissions under the Freedom of Information Act, to the fullest extent possible. Some agency electronic forms (including GSA's) may permit a disclosure to be made with an attached electronic file; if this option is available, contractors may elect to make the written disclosure in a separate electronic document and upload that document, rather than filling out the fields in the electronic form. If not, the contractor may want to consider providing any disclosure to the inspector general in hard copy, rather than through the designated electronic forms available on the internet. Ultimately, this will provide the contractor some measure of control over the content and distribution of the information in its disclosure. It remains to be seen how effective the agencies' electronic forms will be from a practical perspective.

Finally, since mandatory disclosure requirements may extend to subcontractors or teaming partners, contractors should revisit model subcontract or teaming agreements they use to ensure incorporation of flow-down requirements and that necessary disclosures can be made without violating nondisclosure obligations with these business partners. Contractors may also consider whether to include standard terms in subcontracts that permit a prime contractor to conduct investigations involving subcontractor personnel and/or records. While subcontractors likely would push back against a clause that echoes the FAR 52.203-13(c)(2)(G) full cooperation provision, they should recognize that cooperation in prime contractor investigations will diminish the need for a prime contractor to make a defensive, prophylactic disclosure if it suspects subcontractor wrongdoing but is unable to effectively investigate or determine whether credible evidence exists. Internal Control Requirements FAR 52.203-13(c) imposes new mandatory minimum internal control requirements for contractors with a covered contract (small business and commercial item contractors excepted), and this provision will be required for all covered solicitations and contracts (with subcontract flow down as appropriate) issued on or after Dec. 12. Many contractors subject to this requirement likely already have existing internal control mechanisms in place, but must verify that existing mechanisms are consistent with the new rule and that those internal controls are sufficiently formal, documented, and internally available. To this end, contractors should prepare an overlay of their existing procedures versus the new minimum requirements to identify shortfalls, new requirements, or areas for control improvements. Two new minimum control requirements, in particular, are not likely to be part of existing procedures and should be specifically addressed: Excluding Certain Principals: FAR 52.203-13(c)(2)(ii)(B) requires a contractor to take reasonable steps not to include as a principal any person who due diligence would have exposed as having engaged in conduct that conflicts with the contractor's code of business ethics and conduct. Contractors should consider implementing new human resources policies/procedures to conduct adequate background checks to vet current and prospective principals in conjunction with hiring and promotions. Furthermore, contractors should maintain robust personnel files that document any employee violations of the company's code of business ethics and conduct to ensure employees considered for promotion to a principal position are qualified under this new standard. Selecting Subcontractors: It is also worth noting that the preamble to the FAR rule observes that the same reasonable efforts that the contractor may take to excludeprincipals whom due diligence would have exposed as engaging in illegal acts are the same reasonable efforts the contractor should take in selecting its subcontractors. 73 Fed. Reg 67,804. Thus, it may also be prudent for contractors to have documented procedures established for assessing potential subcontractors as team members in this regard. Training Subcontractors: FAR 52.203-13(c)(1)(ii) requires the contractor to provide training to subcontractors and agents as appropriate. Contractors therefore should have controls in place to verify whether a subcontractor has a training program and provide subcontractor training if necessary. This may also require revision of standard subcontract terms and conditions to include training components as appropriate.

 Small and Commercial Item Contractors: Some small businesses and commercial item contractors with less formalized internal procedures may determine that the new enforcement environment and best business practices make more formal internal control procedures prudent, even though those contractors are not required to maintain them under revised FAR 52.203-13(c). At a minimum, such internal controls will provide effective tools for identifying potential violations/overpayments subject to mandatory disclosure requirements, to which these contractors are not exempt. Furthermore, formal procedures better enable the contractor to explain or defend the reasonableness of any internal investigations/internal decision-making processes in the event the contractor decides not to disclose a possible violation for want of credible evidence but later has that decision challenged. Conclusion Under the new rule, two things will happen effective Dec. 12, 2008: (1) all contractors will become subject to the new requirement for timely disclosure to the government where a principal of the contractor has credible evidence of a violation of the False Claims Act or certain federal criminal laws in connection with a federal contract or subcontract, or significant overpayments for all current or prior contracts for which the contractor has received final payment within the last three years; and (2) contractors (other than small businesses or commercial item contractors) with contracts above the $5 million/120 day threshold will start seeing contract and subcontract clauses requiring internal control systems with certain minimum features. The regulations themselves have acknowledged that there is no doubt mandatory disclosure is a sea change and a major departure from the status quo, and contractors will be well advised to take these new requirements seriously, as the consequences for non-compliance, i.e., suspension/debarment, can be profound.