Federal Acquisition Regulation; FAR Case 2007-006, Contractor Business Ethics Compliance Program and Disclosure Requirements, 67064-67093 [E8-26953]

Agencies

• General Services Administration
• National Aeronautics and Space Administration
• DEPARTMENT OF DEFENSE

[Federal Register Volume 73, Number 219 (Wednesday, November 12, 2008)]
[Rules and Regulations]
[Pages 67064-67093]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E8-26953]


-----------------------------------------------------------------------

DEPARTMENT OF DEFENSE

GENERAL SERVICES ADMINISTRATION

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

48 CFR Parts 2, 3, 9, 42 and 52

[FAC 2005-28; FAR Case 2007-006; Item I; Docket 2007-001; Sequence 11]
RIN 9000-AK80


Federal Acquisition Regulation; FAR Case 2007-006, Contractor 
Business Ethics Compliance Program and Disclosure Requirements

AGENCIES: Department of Defense (DoD), General Services Administration 
(GSA), and National Aeronautics and Space Administration (NASA).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Civilian Agency Acquisition Council and the Defense 
Acquisition Regulations Council (Councils) have agreed on a final rule 
amending the Federal Acquisition Regulation (FAR) to amplify the 
requirements for a contractor code of business ethics and conduct, an 
internal control system, and disclosure to the Government of certain 
violations of criminal law, violations of the civil False Claims Act, 
or significant overpayments. This final rule implements Pub. L. 110-
252, Title VI, Chapter 1.

DATES: Effective Date: December 12, 2008.
    Applicability: The Contractor's Internal Control System shall be 
established within 90 days after contract award, unless the Contracting 
Officer establishes a longer time period (See FAR 52.203-13(c)). The 
Internal Control System is not required for small businesses or for 
commercial item contracts.

FOR FURTHER INFORMATION CONTACT: Mr. Ernest Woodson, Procurement 
Analyst, at (202) 501-3775 for clarification of content. For 
information pertaining to status or publication schedules, contact the 
FAR Secretariat at (202) 501-4755. Please cite FAC 2005-28, FAR case 
2007-006.

SUPPLEMENTARY INFORMATION: 

Table of Contents

A. Background
B. Discussion and Analysis
    1. Interrelationship of previous final rule, first proposed 
rule, second proposed rule, and new statute.
    2. Mandatory standards for internal control system.
    3. Mandatory disclosure to the OIG.
    4. Full Cooperation.
    5. Suspension/Debarment.
    6. Extend to violation of civil False Claims Act.
    7. Application to acquisition of commercial items.
    8. Application to contracts to be performed outside the United 
States.
    9. Other applicability issues.
    10. Additional recommendations.
    11. Regulatory Flexibility Act concerns.
    12. Paperwork Reduction Act (PRA).
    13. E.O. 12866.
C. Regulatory Flexibility Act
D. Paperwork Reduction Act

[[Page 67065]]

A. Background

    This case is in response to a request to the Office of Federal 
Procurement Policy from the Department of Justice, dated May 23, 2007, 
and the Close the Contractor Fraud Loophole Act, Public Law 110-252, 
Title VI, Chapter 1. This final rule amends the Federal Acquisition 
Regulation to require Government contractors to--
     Establish and maintain specific internal controls to 
detect and prevent improper conduct in connection with the award or 
performance of any Government contract or subcontract; and
     Timely disclose to the agency Office of the Inspector 
General, with a copy to the contracting officer, whenever, in 
connection with the award, performance, or closeout of a Government 
contract performed by the contractor or a subcontract awarded 
thereunder, the contractor has credible evidence of a violation of 
Federal criminal law involving fraud, conflict of interest, bribery, or 
gratuity violations found in Title 18 of the United States Code; or a 
violation of the civil False Claims Act (31 U.S.C. 3729-3733).
     The rule also provides as cause for suspension or 
debarment, knowing failure by a principal, until 3 years after final 
payment on any Government contract awarded to the contractor, to timely 
disclose to the Government, in connection with the award, performance, 
or closeout of the contract or a subcontract thereunder, credible 
evidence of--
    A. Violation of Federal criminal law involving fraud, conflict of 
interest, bribery, or gratuity violations found in Title 18 of the 
United States Code;
    B. Violation of the civil False Claims Act; or
    C. Significant overpayment(s) on the contract, other than 
overpayments resulting from contract financing payments as defined in 
FAR 32.001, Definitions.
    DoD, GSA, and NASA published a proposed rule in the Federal 
Register at 72 FR 64019, November 14, 2007, entitled ``Contractor 
Compliance Program and Integrity Reporting.'' The public comment period 
closed on January 14, 2008. (This was a follow-on case to the final 
rule under FAC 2005-22, FAR case 2006-007 that was published in the 
Federal Register at 72 FR 65868, November 23, 2007, effective December 
24, 2007.) A second proposed rule was published in the Federal Register 
at 73 FR 28407, May 16, 2008, entitled ``Contractor Compliance Program 
and Integrity Reporting.'' The public comment period on the second 
proposed rule closed on July 15, 2008.
    On June 30, 2008, the Close the Contractor Fraud Loophole Act (Pub. 
L. 110-252, Title VI, Chapter 1) was enacted as part of the 
Supplemental Appropriations Act, 2008. This Act requires revision to 
the FAR within 180 days of enactment, pursuant to 2007-006, ``or any 
follow-on FAR case to include provisions that require timely 
notification by Federal contractors of violations of Federal criminal 
law or overpayments in connection with the award or performance of 
covered contracts or subcontracts, including those performed outside 
the United States and those for commercial items.'' The statute also 
defines a covered contract to mean ``any contract in an amount greater 
than $5,000,000 and more than 120 days in duration.''
    First proposed rule. The first proposed rule, published in the 
Federal Register on November 14, 2007, proposed the following:
    1. New causes for suspension/debarment. A contractor may be 
suspended and/or debarred for knowing failure to timely disclose--
     An overpayment on a Government contract; or
     A violation of Federal criminal law in connection with the 
award or performance of any Government contract or subcontract.
    2. Changes to the requirement for a code of business ethics and 
conduct (52.203-XX).
     Amplify the requirement to promote compliance with the 
code of business ethics.
     Require timely disclosure to the agency Office of the 
Inspector General (OIG), with a copy to the contracting officer, 
whenever the contractor has reasonable grounds to suspect a violation 
of criminal law in connection with the award or performance of the 
contract or any subcontract thereunder.
    3. Mandatory requirements for internal control system based on U.S. 
Sentencing Guidelines (USSG).
     Provide more detail with regard to the ongoing business 
ethics awareness and compliance program (see 52.203-XX 
paragraph(c)(1)).
     Make all the stated elements of the internal control 
system mandatory, rather than examples (see 52.203-XX (c)(2)(ii)).
    A. Add a new paragraph requiring assignment of responsibility 
within the organization for the ethics awareness and compliance program 
and internal control system.
    B. Require reasonable efforts not to include as principals 
individuals who have engaged in illegal conduct or conduct otherwise in 
conflict with the contractor's code of business ethics and conduct.
    C. Provide additional detail with regard to the requirement for 
periodic reviews.
    D. Require that the internal reporting mechanism or hotline must 
allow for anonymity or confidentiality.
    E. Provide that disciplinary action will be taken not only for 
improper conduct, but also for failing to take reasonable steps to 
prevent or detect improper conduct.
    F. Require timely disclosure, in writing, to the agency OIG, with a 
copy to the contracting officer, whenever the contractor has reasonable 
grounds to believe that a violation of Federal criminal law has been 
committed in connection with the award or performance of any Government 
contract performed by the contractor or the award or performance of a 
subcontract thereunder.
    G. Require full cooperation with any Government agencies 
responsible for audit, investigation, or corrective actions.
    Second proposed rule. The second proposed rule, published in the 
Federal Register on May 16, 2008, proposed the following:
    1. Require inclusion of the clause at FAR 52.203-13 in contracts 
and subcontracts that will be performed outside the United States.
    2. Require inclusion of the clause at FAR 52.203-13 in contracts 
(and subcontracts) for all acquisitions of a commercial item. However, 
similar to small businesses, a formal business ethics awareness and 
compliance program and internal control system are not required in 
contracts and subcontracts for the acquisition of commercial items.
    3. Add a new cause for suspension and/or debarment, i.e., knowing 
failure to timely disclose the violation of the civil False Claims Act 
(civil FCA) in connection with the award or performance of any 
Government contract or subcontract.
    The first two of these three proposed changes are now required by 
statute (Pub. L. 110-252, Title VI, Chapter 1). (As pointed out by one 
of the respondents, there was an error in the amendatory language in 
the Federal Register. At FAR 3.1004, the introductory text should have 
been deleted, rather than showing 5 asterisks, indicating that the 
introductory text is still present. However, the preamble made our 
intent very clear and this will be clarified in the final rule).
    Rule on Contract Debts. DoD, GSA, and NASA published a proposed 
rule, FAR case 2005-018, in the Federal

[[Page 67066]]

Register at 71 FR 62230, October 24, 2006, regarding contract debts. 
The final rule was published in the Federal Register at 73 FR 53997, 
September 17, 2008, as part of Federal Acquisition Circular 2005-27. 
The intent of this rule is to evaluate existing controls and procedures 
for ensuring that contract debts are identified and recovered in a 
timely manner, properly accounted for in each agency's books and 
records, and properly coordinated with the appropriate Government 
officials.
    One of the following payment clauses should be included in each 
Government solicitation and contract:

--52.212-4, Contract Terms and Conditions--Commercial Items, basic 
clause and Alternate I.
--52.232-25, Prompt Payment.
--52.232-26, Prompt Payment for Fixed-Price Architect-Engineer 
Contracts.
--52.232-27, Prompt Payment for Construction Contracts.
    These Payment clauses for years have contained the requirement to 
immediately notify the contracting officer if the contractor becomes 
aware of any overpayment on a contract financing or invoice payment. 
Compliance with this requirement fulfills the statutory requirement of 
Pub. L. 110-252 for timely notification of overpayments.
    In addition, under the Contract Debts rule, these Payment clauses 
were modified to require that if the contractor becomes aware of a 
duplicate contract financing or invoice payment or if the contractor 
becomes aware that the Government has otherwise overpaid on a contract 
financing or invoice payment, the contractor shall--
     Remit the overpayment amount to the payment office cited 
in the contract along with a description of the overpayment; and
     Provide a copy of the remittance and supporting 
documentation to the contracting officer.
    Because issues of overpayment were addressed in FAR case 2005-018, 
the Councils did not include additional coverage on contract debt in 
the subject FAR Case, except for adding--
     Knowing failure to timely disclose significant overpayment 
as a cause for debarment/suspension as stated at Subpart 9.4 Debarment, 
Suspension, and Ineligibility; and
     A cross reference at 3.1003(a)(3) to this new cause of 
suspension/debarment at Subpart 9.4.

B. Discussion and Analysis

    The FAR Secretariat received 43 responses to the first proposed 
rule. The FAR Secretariat received comments on the second proposed rule 
from 25 respondents of which 15 respondents had also submitted comments 
on the first proposed rule and 10 respondents were submitting comments 
for the first time. Overall, 18 of the 53 respondents were from 
Government agencies, including many responses from agency Offices of 
the Inspector General (OIG).
    In the second proposed rule the Councils specifically requested 
comments on three issues:
     Elimination of the exemption from inclusion of the clause 
FAR 52.203-13 for contracts and subcontracts that will be performed 
entirely outside the United States.
     Elimination of the exemption from inclusion of the clause 
FAR 52.203-13 for contracts (and subcontracts) for all acquisitions of 
a commercial item under FAR Part 12.
     Requirement for mandatory disclosure of violations of the 
civil FCA (31 U.S.C. 3729-3733) (in the clause, in the internal control 
system required by the clause, and as a cause for suspension or 
debarment).
    Comments on the second proposed rule that do not relate to these 
three issues, unless presenting a new and pertinent perspective, have 
not been separately addressed in this preamble.

1. Interrelationship of Previous Final Rule, First Proposed Rule, 
Second Proposed Rule, and New Statute

a. Previous Final Rule, FAR Case 2006-007
    The first proposed rule under FAR case 2007-006 (``first proposed 
rule''), proposed increases to the requirements introduced by final 
rule, FAR case 2006-007 (``previous final rule''), in the ways 
enumerated in the Background section above. Thirteen respondents 
remarked on the relationship to the previous final rule, some 
suggesting changes to the previous final rule as well as the first 
proposed rule.
    i. Like the previous final rule under 2006-007.
     No further change needed. One respondent expressed the 
belief that the previous final rule is adequate to protect the 
Government's interest. Several other respondents supported the previous 
final rule's voluntary disclosure. One respondent questioned the need 
for the first proposed rule in light of the recent implementation of 
``more expansive contractor compliance standards in the FAR.''
     The first and second proposed rules enhance the previous 
rule. One Government agency explicitly supported the major provisions 
of both rules as sound business practices, highlighting their 
contribution to cost control as well as mission safety.
    Response: No response necessary.
    ii. Ethics code. With regard to the requirement for a code of 
conduct, one respondent considered that just having a code is 
meaningless. Several other respondents also objected to the requirement 
for a code of business ethics and conduct in the previous final rule 
under FAR case 2006-007, stating that existing contractor ethics 
standards work well and that these contractual requirements are 
redundant, add costs and other burdens, and are likely to generate 
additional uncertainties.
    Several respondents objected to the outdated method of 
communicating the code, requiring a copy to each employee engaged in 
the contract. One respondent recommended that it may be more effective 
to refer employees to Web sites or provide tutorials in person, on-
line, or through other means. This suggestion could minimize burdens 
through the use of information technology, as requested in the preamble 
to the proposed rule for this case.
    Another respondent also objected that many institutions have more 
than a single code of conduct, each addressing different aspects of 
conduct that together cover all aspects of conduct that the FAR rule 
requires.
    Response: The Councils do not agree that a code of conduct is 
meaningless. It can serve several related purposes. For a firm's 
business partners, including the Government, it provides a basis for 
evaluating the firm's responsibility, including special standards of 
responsibility when appropriate. It also provides a basis for internal 
policy development, for example human resources policies. And when 
something goes wrong, the code is meaningful for enforcement and for 
understanding and perhaps incorporating lessons learned.
    While requiring establishment of a code will add costs and require 
effort on the part of entities that do not have them already, the 
Councils agree with several respondents that those resources are 
reasonable and justified to mitigate other and larger risks to the 
success and efficiency of Government projects. Because many entities 
already have made the investment, the rule will level the playing field 
in competitive environments.
    The Councils agree that flexibility in the method of communicating 
the code to employees is appropriate, and the rule has been changed to 
require that it be made available to each employee engaged in 
performance of the contract. The Councils note that the rule does not 
preclude having multiple codes of

[[Page 67067]]

conduct applicable to different segments of contractors' business 
lines.
    iii. Training.
     Training requirement is too burdensome. One respondent was 
concerned that the requirements for training could take substantial 
time away from performing on their contracts to train staff on an 
unknown scope of Federal criminal law. The Government would incur costs 
from this activity through delays in the fulfillment of contracts and 
increased contractor expenses that will be passed along to customers.
    Response: The Councils recognize that contract costs are reflected 
in prices, but do not consider schedules to be impacted by this 
requirement. By identifying the scope of violations of the Federal 
criminal law as those involving fraud, conflict of interest, bribery, 
or gratuity violations found in Title 18 of the United States Code, the 
Councils believe that the training requirements have been more clearly 
defined and the contractor's training requirement has been reduced.
     Require training on civil FCA. Several respondents 
proposed that Government contractors be required to educate their 
employees about the protections available under the civil FCA. The 
Department of Justice, Criminal Division (DoJ) suggested that 
contractors should also be required to include in their ``business 
ethics awareness'' obligation, reflected in the proposed rule at FAR 
52.203-13(c)(2)(ii)(F), training on the civil FCA.
    Response: The Councils do not agree that it is necessary under this 
case to dictate to contractors what they need to cover in business 
ethics training. If we highlight education on the civil FCA, or other 
specific areas, the contractors may place undue emphasis only on those 
areas mentioned in the regulations. The business ethics training 
courses may cover appropriate education on the civil FCA, as well as 
many other areas such as conflict of interest and procurement integrity 
and other areas determined to be appropriate by the contractor, 
considering the relevant risks and controls.
    iv. Hotline posters. One respondent commented that the physical 
display of multiple hotline posters in common work areas is impractical 
and wasteful. Another respondent also objects to using hotline posters 
on the walls of the institution as being the most effective way of 
communication at every institution.
    Response: The issue of multiple hotline posters was resolved under 
the final rule 2006-007. The requirement for hotline posters is outside 
the scope of this case.
b. Relationship of Second Proposed Rule to First Proposed Rule
    One respondent questioned whether certain requirements of the first 
proposed rule that did not appear in the second proposed rule had been 
deleted.
    Response: The preamble of the second proposed rule specified that 
it included only the sections of the rule affected by the three 
changes; it was only addressing three issues, not providing a 
completely revised proposed rule. Therefore, the fact that language in 
the first proposed rule that would not be affected by the 3 issues of 
concern was not repeated in the second proposed rule does not imply 
that that language was being deleted.
c. Relationship of Second Proposed Rule to New Statute
    One respondent recommends that any disclosure requirement be 
limited to violations of the types specified in the ``Closing the 
Contractor Fraud Loophole Act (Pub. L. 110-252, Title VI, Chapter 1)'' 
(i.e., exclude violations of the civil FCA). This respondent also 
states that the statute does not require the disclosure to the OIG and 
the penalties of debarment/suspension are not required by the new 
statute, so should be eliminated.
    Another respondent also makes the point that since the new law does 
not address disclosure of violations of the civil FCA, that requirement 
should not be included in the final rule under this case.
    One respondent notes particularly that the new law does not require 
the ``reasonable grounds to believe'' standard, reporting to the 
Inspector General, or failure to report as an independent basis for 
suspension or debarment.
    Response: This rule was initiated as a matter of policy. Although 
the new statute reinforces and provides a statutory basis for some 
aspects of the rule, the fact that any part of the rule is not required 
by statute does not alter the rationale that provided the underpinning 
for those aspects of the rule. Each aspect of the rule not required by 
statute must be considered on its own merits.

2. Mandatory Standards for Internal Control System

a. Minimum Requirements for the Internal Control System
    One respondent considered that the previously recommended, now 
mandatory, internal control practices will be inadequate if they are 
considered to be maximum as well as minimum requirements. Another 
respondent considered the establishment of an internal control system 
that satisfies a laundry list of mandates will be overly burdensome. 
Another respondent would prefer that contractors be left free to choose 
to implement the USSG ``in the prudent exercise of their business 
discretion,'' rather than being required to do so. Likewise, another 
respondent stated that contractors may want to consider the USSG in 
designing compliance programs but, absent a statute or Executive order, 
they should not be made mandatory in the regulations.
    Response: The rule does reflect minimum expectations. Competing 
firms are free to establish the highest ethical standards they consider 
to be appropriate to the business at hand. This case establishes a 
framework for institutional ethics management and disclosure and does 
not prescribe specific ethical requirements.
b. Relation of Rule to the USSG
    i. Rule is consistent with the USSG. An agency OIG stated that the 
proposed rule should benefit Federal contractors. It provides guidance 
for contractors consistent with U.S. Sentencing Commission guidance on 
effective compliance and ethics programs for organizations. Compliance 
with the rule should assist contractors subject to the Sarbanes-Oxley 
Act of 2002 in fulfilling their responsibilities under the Act.
    Response: None needed.
    ii. USSG should be incorporated by reference. Several respondents 
commented that rather than using the ad hoc form of the USSG standards 
for compliance and ethics program, the actual USSG standards should 
simply be incorporated by reference. Conformity with the USSG will 
prevent contractors unknowingly failing to comply with all the USSG 
although complying with the FAR. Formal adoption of the USSG will 
create uniform criteria. A respondent recommended that all the 
descriptive paragraphs in (ii) be deleted, instead inserting: ``The 
Contractor's internal control system shall provide for a compliance and 
ethics program that meets the standards of the Federal Organizational 
Sentencing Guidelines, as amended from time to time, United States 
Sentencing Commission Guidelines Manual: Sentencing of Organizations, 
section 8B2.1.
    Response: These respondents would use the USSG Guidelines, in place 
of the FAR spelling out the required elements of internal control 
systems. However,

[[Page 67068]]

the Councils prefer to spell out the elements. This lets the 
contractors know what is expected. The USSG are the source of the FAR 
text, but the FAR text is intentionally not adopting them verbatim. The 
procurement regulations are not the USSG; the contractor setting up an 
internal control system is in a different situation than a company 
accused of a crime. Some elements of the USSG are not appropriate for a 
procurement regulation. However, by making the minimum requirements 
generally consistent with the USSG, the Councils believe that a 
contractor should be in a better position if accused of a crime.
    iii. Essential parts of the USSG are missing. One respondent 
commented that essential parts of the USSG are missing. One example is 
the reference to the use of an incentive system in compliance programs 
that encourages and rewards companies for implementing effective 
programs, following the model of the Organizational Sentencing 
Guidelines. The respondent recommends modifying 52.203-13(c)(1)(ii)(E) 
by inserting after ``detect improper conduct'' the words ``and 
appropriate incentives to perform in accordance with the compliance and 
ethics program''.
    Another example the respondent uses is the standard for effectively 
responding to violations, and taking steps to prevent recurrence. 
Without these, a company's program would not be considered effective 
under the USSG.
    Response: The Councils note that the respondent must have intended 
to cite FAR 52.203-13(c)(2)(ii)(E). The Councils do not want to require 
incentives for employees within contractors' internal control systems. 
This is within companies' discretion. The mitigating factors for 
debarment (9.406-1(a)) already include consideration of remedial action 
(e.g., (6), (7), and (8)) taken by the contractor.
    The FAR does cover responding to violations, and preventing 
recurrence, in FAR 52.203-13(c)(2)(i), and throughout (c)(2)(ii).
c. Principals
    Several respondents asked for interpretation of the clause 
paragraph (c)(2)(ii)(B) requirement that the internal control system 
provide for reasonable efforts not to include within the organization 
principals whom due diligence would have exposed as having engaged in 
conduct that is illegal or otherwise in conflict with the Contractor's 
code of business ethics and conduct.''
     Is the ``organization'' the entire contractor, instead of 
the organization responsible for the code?
     Is the code retroactive to catch criminal behavior in the 
past?
     Is it only Federal crimes, or state and local as well?
     What about non-criminal behavior that did not violate the 
Contractor's code at the time?
     What kind of due diligence is necessary--a simple pre-
employment questionnaire, or instead a costly background check with 
interviews of friends and neighbors?
    Response:
     The Councils have revised the draft final rule (paragraphs 
(c)(2)(ii)(A), (B), and (C) of the clause 52.203-13) to eliminate use 
of the term ``organization''. This term was a carryover from the USSG. 
This rule is addressed to the contractor--the entity that signed the 
contract, and subcontractors thereunder.
     The code of conduct is not itself retroactive. However, it 
is necessary to distinguish conduct of an employee during his/her 
employment, from past conduct uncovered during a background check of a 
prospective hire. That past conduct need not be disclosed to the 
Government, but should be part of the decision whether to hire the 
individual.
     Past criminal behavior of any type, even criminal behavior 
unrelated to contracting, calls into question whether the individual at 
the present time has integrity and is a proper role model for company 
staff. This is not a mandate to fire the individual, but to determine 
whether the individual is currently trustworthy to serve as a principal 
of the company.
     Behavior that was not criminal and did not violate a 
business's code as it existed at the time, is not the subject of this 
rule. In response to this comment, the Councils have revised paragraph 
(c)(2)(ii)(B) to delete the words ``illegal or otherwise.'' The term 
``illegal'' is too broad and could include even a traffic violation. 
The Contractor's code of business ethics and conduct should cover the 
types of behavior that this requirement is intended to address.
     The level of background check required depends on the 
circumstances. This is a business decision, requiring judgment by the 
contractor.
    The source of the FAR clause paragraph (c)(2)(ii)(B) is the USSG 
Manual paragraph 8B2.1.(b)(3). The Commentary on this paragraph 
includes this statement: ``With respect to the hiring or promotion of 
principals, an organization shall consider the relatedness of the 
individual's illegal activities and other misconduct (i.e., other 
conduct inconsistent with an effective compliance and ethics program) 
to the specific responsibilities the individual is anticipated to be 
assigned and other factors such as: (i) the recency of the individual's 
illegal activities and other misconduct; and (ii) whether the 
individual has engaged in other such illegal activities and other such 
misconduct.''
d. Periodic Review
    One respondent asked for an interpretation of the clause paragraph 
(c)(2)(ii)(C) requirement for periodic review of business practices. 
For ``monitoring and auditing'', is standard business practice and 
generally acceptable accounting principals sufficient? What system for 
assessing the ``risk of criminal conduct'' would be sufficient? Is 
there a Government program that is an acceptable process?
    Response: Standard business practice for ``monitoring and auditing 
to detect criminal conduct'' which conforms to generally accepted 
accounting principles should be sufficient. The ``monitoring and 
auditing'' is amplification of the current FAR requirement for periodic 
review and auditing, from the FAR case 2006-007 published in November 
2007.
    One respondent stated that annual audits of research processes may 
already review compliance with policies for ethical conduct of research 
funded under Federal contracts. The FAR can acknowledge, through an 
Alternate to the clause, that duplication of review is not required 
where reviews under other rules already cover the necessary subjects.
    Response: The FAR is not requiring wasted duplication of effort. No 
change to the regulation is necessary.

3. Mandatory Disclosure to the OIG

    Of the 43 respondents that commented on the first proposed rule, 36 
commented specifically on sub-paragraph (b)(3) of the clause 52.203-13, 
Contractor Code of Business Ethics and Conduct, which requires 
mandatory disclosure, in writing, to the agency OIG, with a copy to the 
contracting officer, whenever the contractor has reasonable grounds to 
believe that a principal, employee, agent, or subcontractor of the 
contractor has committed a violation of Federal criminal law in 
connection with the award or performance of the contract or any 
subcontract thereunder.
    Six agency OIGs, as well as several Government agencies all 
specifically concurred with the mandatory disclosure of violations by 
contractors.

[[Page 67069]]

    Other respondents, including agency OIGs, while concurring with 
mandatory disclosure, suggested improvements in the way this 
requirement is implemented in the rule.
    The other 17 respondents that commented specifically on the 
mandatory disclosure disagreed with this approach and recommended 
voluntary disclosure.
a. Need for Mandatory Disclosure
    Note that the following comments in this section all preceded the 
enactment of the statute that requires mandatory disclosure, so that 
the issues are now primarily moot.
    i. Major departure from long-standing policy. One respondent stated 
that this rule is a major departure from long-standing and proven 
Federal policies that encourage voluntary disclosures. Likewise, 
another respondent stated that mandatory disclosure runs counter to 
many established Government processes. One respondent considered the 
proposed regulation to be a ``sea change'' in the fundamental approach 
to compliance followed by the Government. Another respondent noted that 
in 1986 a proposal from DoD to make fraud disclosures mandatory 
foundered on ``state action'' grounds. In 1988, then Secretary of 
Defense Richard Cheney withdrew a proposed rule that would have 
governed such programs on the grounds that ``to be meaningful, 
corporate codes of conduct must be adopted by contractors voluntarily, 
not mandated in procurement regulations (54 FR 30911)''. Another 
respondent also cited a 1996 GAO report on the DoD Voluntary Disclosure 
Program (GAO/NSIAD-96-21) in which the GAO quotes the DoJ as praising 
the DoD Voluntary Disclosure Program.
    Several respondents cited the DFARS regulations as being a model 
for voluntary disclosure. Several other respondents stated that many 
Federal agencies that have considered mandatory disclosure rules have 
declined to adopt them in favor of voluntary disclosure programs (e.g., 
Department of Health and Human Services in 2000 (65 FR 40170) and in 
2004 (69 FR 46866)).
    Response: There is no doubt that mandatory disclosure is a ``sea 
change'' and ``major departure'' from voluntary disclosure, but DoJ and 
the OIGs point out that the policy of voluntary disclosure has been 
largely ignored by contractors for the past 10 years. In addition, in 
that same time period mandatory disclosure has been adopted for banks 
and public companies and stressed by the U.S. Sentencing Commission and 
DoJ, as further discussed in the following sections.
    ii. Is voluntary disclosure working? Various respondents stated 
that the proposed rule fails to demonstrate that there is a need for 
change based on failure of voluntary disclosure. According to these 
respondents, neither DoJ nor the Councils have cited data supporting 
the claim that voluntary disclosure is not effective. One respondent 
stated that a purported paucity of participants in the DoD IG Voluntary 
Disclosure Program does not establish a decline in contractor 
disclosures to the Government sufficient to justify a mandatory 
disclosure requirement. Another respondent stated that DoJ is comparing 
the last few years to data from 20 years ago. One respondent cited 
disclosures for FY 2005-2007 that are relatively level. Another 
respondent cited the December 2006 issue of Corporate Counsel that 
voluntary disclosures are increasing rather than decreasing, citing Mr. 
Mark Mendelssohn of DoJ and a recent report by Sherman & Sterling. Even 
if there is a decline in disclosure under the DoD Voluntary Disclosure 
Program, another respondent found that the leap to mandatory disclosure 
``gives rise to a perverse implication that justification for mandating 
regulations can be asserted simply because no one has shown that the 
activity to be regulated is not happening.''
    One respondent stated that the assumptions about the reason for the 
decrease are misplaced. Another respondent firmly believed that there 
is need for analysis of the reasons for any decline in voluntary 
disclosures. Even if mandatory disclosures to the DoD IG Voluntary 
Disclosure Program are decreasing, several respondents suggested the 
following possible explanations:
     Less emphasis by DoD.
     Fewer reportable violations.
     More instances resolved as contract matters, with reports 
to contracting officers or heads of contracting activities or to audit 
agencies like DCAA and DCMA.
     Perception that the Government is slow in processing 
voluntary disclosures.
     Lack of restrictions on use of disclosure reports in 
criminal or civil actions or in administrative actions against 
individuals.
    One respondent elaborated that there may be fewer voluntary 
disclosures because self-governance is working to prevent and detect 
contract formation and contract performance issues before they result 
in criminality or civil fraud. Reduction in the rate of voluntary 
disclosures would be an expected byproduct of improved internal 
processes, enhanced training, better internal controls, and an improved 
culture of ethics and compliance.
    One respondent stated that a number of companies have commented 
that delays in processing disclosures to the OIG are a significant 
factor in their decision to report problems to the contracting officer 
instead of to the DoD Voluntary Disclosure Program.
    One respondent suggested other avenues for disclosure that are more 
relevant to the kinds of illegal activity being found these days, such 
as--
     The DoJ Antitrust Division. Voluntary disclosures to DoJ 
have increased as disclosures to the DoD IG program have decreased (see 
https://www/usdoj.gov/atr/public/speeches/232716.htm#N_1--);
     The Department of State Directorate of Defense Trade 
Controls. This program has been very successful at inducing voluntary 
disclosures (see GAO-05-234 (Feb 2005)); and
     Foreign Corrupt Practices Act. Enforcement actions for 
violations of the FCPA have also grown, again largely due to voluntary 
disclosures made by corporations (see ``U.S. Targets Bribery Overseas 
Globalization; Reforms Give Rise to Spike in Prosecutions,'' The 
Washington Post (Dec 5, 2007)).
    One respondent suggested that mandatory reporting should be 
replaced with a strong voluntary disclosure program modeled after the 
DoJ Antitrust Division's Corporate Leniency Programs.
    Another respondent noted that it is DoJ, not DoD, that apparently 
believed that the mandatory disclosure provisions were necessary. This 
respondent interpreted this to mean that DoD is satisfied with the 
number and types of disclosures being made.
    One respondent stated that DoJ should be required to demonstrate 
that there is an upward trend of criminal prosecutions of the top 100 
Government contractors where it was established that contractor 
principals were aware of violations of the law and made a conscious 
decision not to disclose those violations to the Government. Similarly, 
another respondent suggested that DoJ should offer factual support for 
its thesis that crimes are occurring and being found and yet not being 
reported voluntarily. One respondent also wanted DoJ to explain why 
other less burdensome changes, such as improving the existing voluntary 
disclosure programs, cannot be used to achieve the desired result.
    On the other hand, in the DoJ letter of May 23, 2007, DoJ stated 
that its

[[Page 67070]]

experience suggests that few corporations have actually responded to 
the invitation of DoD that they report or voluntarily disclose 
suspected instances of fraud. An agency OIG stated that the vast 
majority of crimes involving contractors that it investigates are not 
reported by the contractor. Another agency OIG stated that Government 
contractors are coming forward significantly less frequently with 
voluntary disclosures. It considered that this mandatory requirement 
may be the most effective way for the Government to monitor its 
vendors.
    Response: In the DoJ letter dated May 23, 2007, which requested the 
Administrator of the Office of Federal Procurement Policy, Mr. Paul 
Denett, to open this case, DoJ states that its experience suggests that 
few companies have actually responded to the invitation of DoD to 
report or voluntarily disclose suspected instance of fraud. The 
respondents do not dispute that relatively few contractors are using 
the DoD Voluntary Disclosure Program. The contractor groups, in their 
public comments on the rule, implicitly concede that the Voluntary 
Disclosure program is not being used and blame DoJ and the OIG. Some 
claim that informal disclosures are being made to the contracting 
officers but offer no specific evidence.
    Even if it is true that there are comparatively fewer violations 
now than 20 years ago or that some situations are resolved 
administratively, there are still significant numbers of violations 
occurring and being prosecuted that have not been self-disclosed.
    Importantly, the incentive to self-disclose Antitrust violations is 
not applicable. Antitrust deals with the Sherman Act and the Clayton 
Act, which prohibit conspiracy in restraint of interstate or foreign 
trade and regulate practices that may be potentially detrimental to 
competition (price discrimination, exclusive dealing contracts, etc.). 
Under the Antitrust Division's Corporate Leniency Program, the first 
company that reports the violation receives immunity from prosecution. 
That type of circumstance does not apply here.
    iii. Existing legal requirements and regulations as models for the 
rule.
    In the DoJ letter of May 23, 2007, DoJ stated that--
     Unlike healthcare providers or financial institutions, 
there is at present no general requirement that contractors alert the 
Government immediately as a matter of routine when fraud is discovered;
     DoJ has been careful not to ask contractors to do anything 
that is not already expected of their counterparts in other industries;
     Our Government's expectations of its contractors has not 
kept pace with the reforms in self-governance in industries such as 
banking, securities, and healthcare. Several respondents all considered 
that for far too long contractors have played by different rules than 
their counterparts in other industries, such as health care providers 
and research grant recipients. A Government agency commented that 
healthcare providers and banks have had such a requirement for many 
years. An agency OIG commented that in the past 15 years there have 
been significant reforms in industries such as banking, securities, and 
healthcare, yet we have not asked the same of Government contractors.
    In the DoJ letter of May 23, 2007, DoJ stated that the requested 
changes are modeled on existing requirements found in other areas of 
corporate compliance such as the Sarbanes-Oxley Act of 2002 and expand 
slightly on the Contractor Standards of Conduct in DFARS 203.7000. DoJ 
also noted that the National Reconnaissance Office (NRO) has begun 
requiring its contractors to disclose contract fraud and other illegal 
activities.
    a. More far-reaching. However, one respondent stated that the 
proposed rule imposes substantially more far-reaching and draconian 
disclosure obligations on Government contractors than those presently 
made applicable to financial institutions by submission of Suspicious 
Activity Reports (12 CFR 21.11). The financial institution has to 
report a crime if the financial institution is an actual or potential 
victim of the criminal activity. Where a contractor is a victim of a 
crime committed by an employee or another person, the employee's 
conduct is not imputed to the contractor. Therefore, the corporation 
does not incur the risk of criminal liability when it reports an 
employee violation and is not incriminating itself.
    According to another respondent, the current laws and regulations 
are not sweeping and burdensome, but are specific and narrowly focused. 
The respondent pointed out that the Anti-Kickback Act and Foreign 
Corrupt Practices Act limit their mandatory disclosure to a very 
limited class of activity. The respondent also pointed out that 
Sarbanes-Oxley contemplates internal reporting mechanisms and review 
mechanisms at the highest levels before any reporting occurs. The other 
respondent also addressed the internal control certification required 
by the Sarbanes-Oxley Act of 2002. Sarbanes-Oxley applies to a 
contractor that is a public company. Section 302 of Sarbanes-Oxley does 
not require that a public company disclose to the Government conduct it 
believes may be a violation of criminal law.
    Response: Many of the public comments reveal a basic 
misunderstanding of the existing mandatory disclosure requirements 
found in the healthcare, banking, and securities areas. Each 
requirement effectively mandates disclosure of fraud as broad as the 
particular regulatory issue being addressed can reach. Beyond that 
limitation, these other requirements are no more limited than the 
proposed rule, particularly with the further changes in the final rule 
with regard to the types of Federal crimes covered.
    In particular, the Councils do not agree with the interpretation of 
12 CFR 21.11. 12 CFR 21.11 requires financial institutions to report 
suspicious activities committed or attempted against the bank or 
involving a transaction or transactions conducted through the bank, 
where the bank was used to facilitate a criminal transaction.
    Even though Section 302 of Sarbanes-Oxley does not require a public 
company to disclose to the Government conduct it believes may be a 
violation of criminal law, there are pre-existing securities laws and 
regulations that require disclosure to the SEC. Sarbanes-Oxley does not 
provide immunity from prosecution for wrong-doing but provides 
protection against third-party liability with regard to a lawsuit by 
the persons accused of wrongdoing.
    b. Conforming the FAR? One respondent stated that if the FAR 
Council is relying on conforming the FAR to regulations applicable to 
other industries as a justification, the Council should state this 
explicitly and provide a detailed analysis of the regulations in other 
areas on which it is relying.
    Response: The Councils did not rely on conforming the FAR to 
regulations applicable to other industries as a justification, but 
merely cited some parallels. The FAR regulations are designed to suit 
the particular circumstances of acquisition.
    c. Particular public need/statutory basis? One respondent stated 
that current disclosure programs are not instructive. The respondent 
also stated that these programs are targeted towards a particular 
public need, and in most cases are the product of legislation that was 
enacted in response to a particular public scandal or important 
national need. In enacting statutory schemes, Congress saw a particular 
need and targeted legislation to address the particular need (Sarbanes-
Oxley, the

[[Page 67071]]

Anti-Kickback Act, the Foreign Corrupt Practices Act, and banking 
laws).
    Several respondents were concerned that the same justification does 
not exist for this proposed rule as the cited statutes and regulations. 
One respondent stated that the Council has not provided a rational 
basis to explain why such a significant change to the FAR is necessary. 
The respondent asserted that the proposed rule could be challenged 
under the Administrative Procedure Act (APA) because the FAR Council 
has not provided a ``rational basis'' to justify the mandatory 
disclosure requirement, nor is there statutory authority behind the FAR 
Council to issue a regulation providing for mandatory disclosure of 
criminal acts. The respondent therefore concluded that the FAR Council 
lacks the authority to issue the regulation (See AFL/CIO v. Kahn, 472 
F. Supp. 99 (D.D.C. 1979), rev'd, 618 F. 2d 784 (D.C.Cir. 1979)). One 
respondent saw this as particularly important in light of DoJ's 
reliance upon the example of other statutorily-mandated disclosure 
programs (Sarbanes-Oxley, Foreign Corrupt Practices Act, etc.) as 
justification for this regulatory initiative. The respondent stated 
that the mandatory disclosure provisions in the proposed rule are 
neither the product of specific findings or legislation, nor any 
perceived critical national need, and thus are not appropriately 
compared to other existing mandatory disclosure programs.
    Response: The DoJ proposed a mandatory disclosure program in order 
to emphasize the critical importance of integrity in contracting. The 
public demands honesty and integrity in corporations with which the 
Government does business. If there is concern that there is not a 
current public need warranting proceeding with this case, the Councils 
cite the public outcry over the overseas exemption in the first 
proposed rule and the recent enactment of the Close the Contractor 
Fraud Loophole Act (Pub. L. 110-252, Title VI, Chapter 1). The Act 
requires exactly what the first rule proposed, except that the overseas 
and commercial item exemptions have been eliminated. However, the rule 
did not require this legislation in order to have the authority to 
proceed in this case. The Councils issue rules under the authority of 
the Office of Federal Procurement Policy Act as well as 40 U.S.C. 
121(c), 10 U.S.C. chapter 137, and 42 U.S.C. 2473(c). The Administrator 
for Federal Procurement Policy may prescribe Governmentwide procurement 
policies to be implemented in the FAR (41 U.S.C. 405). This case was 
opened at the request of OFPP. This case is making clear what was 
already expected. It is not unreasonable or ``capricious'' to require 
contractors doing business with the Government to disclose violations 
of the civil False Claims Act (civil FCA) or a violation of Federal 
criminal law involving fraud, conflict of interest, bribery, or 
gratuity violations found in Title 18 of the United States Code that 
have occurred in connection with the award, performance, or closeout of 
any Government contract performed by the contractor or a subcontract 
thereunder. Existing DoJ guidelines addressing corporate prosecution 
standards, while certainly not providing amnesty, suggest that if a 
company discloses such violations, the prosecution will be of the 
individuals responsible for the violation, not the entire organization.
    d. Empirical support that mandatory disclosure will achieve the 
Councils' objective. One respondent stated that mandating disclosure 
without empirical support to show that it will achieve the Councils' 
objectives will be susceptible to challenge. The APA requires courts to 
strike down rules devoid of factual support. Another respondent also 
cited the APA, and that a rule may be set aside if it is arbitrary or 
capricious (5 U.S.C. 706).
    Response: The Councils point to the testimony from DoJ and various 
OIGs that the experience with the NRO mandatory disclosure clause has 
been positive (see next paragraph). The Councils further cite the 
enactment of the Close the Contractor Fraud Loophole Act (see prior 
section), which now mandates many of these revisions to the FAR.
    e. The NRO requirement. An agency OIG noted that similar 
contractually imposed disclosure requirements have been successfully 
implemented by the NRO. According to DoJ, the NRO reports that this 
requirement has improved its relationships with its contractors and 
enhanced its ability to prevent and detect procurement fraud. Another 
agency OIG stated that adoption of the NRO clause resulted in increased 
and earlier disclosure of wrongdoing and better working relationships 
built upon greater sharing of information and trust. It also led to the 
conclusion that it is more effective for a contractor to mandatorily 
disclose information pursuant to a requirement, than it is for a 
contractor to be in a position of offering up information that it could 
be criticized, or even sued, for providing.
    One respondent, however, stated that the NRO requirement is not an 
appropriate model for all Government contractors because it requires 
disclosure of potential illegal activity related to the conduct of 
intelligence operations in the interest of national security and thus 
is not instructive. In fact, according to another respondent, the 
unique nature of the NRO and its responsibilities are major reasons 
cited as justification for its disclosure program. Similarly, the other 
respondent stated that, while the NRO's mandatory disclosure program 
was not the product of legislation, it was the direct product of an 
obvious and public awareness that we live in a different world after 
September 11, 2001.
    Furthermore, several respondents cited problems with the NRO 
disclosure program. One respondent stated that ``it is far from clear 
at this point whether the NRO mandatory disclosure program is or will 
be productive'', citing anecdotal reports from the contractor community 
suggesting that the program is not as effective as the NRO claims. One 
respondent cited problems experienced by contractors subject to the NRO 
OIG reporting clause, claiming that the NRO OIG has inserted itself in 
the administration of contracts by using the clause as the basis to 
become involved in all aspects of the contractor ethics functions and 
corporate investigations. For example, the respondent stated that the 
OIG has used this clause to investigate, as a Federal offense, matters 
as mundane as employees who have been disciplined for leaving work 
early while reporting they were present. The respondent does not 
believe that OIG agents should be routinely involved in company 
internal ethics functions and contract administration. The respondent 
quoted Mr. Paul Denett, Administrator of the Office of Federal 
Procurement Policy: ``The IG serves a purpose, but it needs to be 
limited to core areas.''
    However, the response from the National Procurement Fraud Task 
Force (NPFTF), signed by the IG of the NRO, stated that the requirement 
for mandatory reporting has worked very well at NRO: The reporting of 
wrongdoing has increased, comes earlier, and has led to a good working 
relationship. NPFTF considers that this model can have a similar impact 
across the Federal Government, and that the situation at NRO is not 
unique.
    Response: Almost all the agency OIGs submitting public comments 
cite the success of the clause initiated by the NRO OIG as a reason for 
supporting this rule for their agency procurements.
    As to limiting the role of the OIG to its core area, the core area 
of the OIG is to investigate fraud, conflict of interest, bribery, and 
gratuity violations. OIG agents will not be routinely involved in 
company internal ethics functions and

[[Page 67072]]

contract administration unless violations are disclosed. The final rule 
has been revised to more closely focus the situations that must be 
disclosed by limiting violations of criminal law to violations 
involving fraud, conflict of interest, bribery, or gratuity violations 
found in Title 18 of the United States Code (see B.3.b.iii.).
    iv. Will mandatory disclosure make reporting easier or better? In 
the DoJ letter of May 23, 2007, DoJ stated that if the FAR were more 
explicit in requiring such notification, it would serve to emphasize 
the critical importance of integrity in contracting. An agency OIG 
stated that the requirement will simplify the contractors' decision on 
whether to disclose suspected violations. Likewise, another agency OIG 
stated that the contractor is in a stronger position when reporting for 
the purpose of complying with a mandatory requirement than if 
voluntarily disclosing information, for which it could be criticized, 
or even sued. Another agency OIG commented that making self-reporting a 
requirement gives the honest contractor employees necessary leverage 
over those who may seek to shield the employer when wrongdoing is 
noticed or suspected.
    On the other hand, some other respondents believed that if 
employees know that everything they report will be passed on to the 
Government, this may result in less reporting up the chain of the 
company rather than more. One respondent saw substantial potential to 
decrease rather than enhance cooperation with company compliance 
efforts.
    The respondent was concerned that the likelihood of severe 
consequences will necessarily change the relationship of the company 
and its employees. Every interview will have the potential of resulting 
in employees being reported. It may be that investigative targets may 
not only be entitled to counsel, but to Miranda warnings, if the 
company is deemed to be acting on behalf of the Government. Further, 
another respondent was concerned that mandatory reporting may violate 
existing contracts with a labor union and may be an unfair labor 
practice if imposed without bargaining, citing American Elec. Power 
Co., 302 NLRB 161(1991). Resistance by the employees can undercut the 
entire compliance program. A respondent also believed that employees 
may be reluctant to come forward if they are aware that the contractor 
will be required to report their co-workers, or report the company 
itself, to the OIG. This respondent cited studies by the framers of the 
USSG who undertook significant research addressing these issues.
    Response: The Councils believe that by mandating disclosure, 
contractor executives and their counsel will be more inclined to make 
the required disclosure to the OIG, as opposed to either not disclosing 
or informally alerting the contracting officer, who is not in a 
position to evaluate the criminal behavior of individual employees. By 
mandating disclosure to the OIG, the rule will add weight to the 
arguments inside a corporation that good business practices in the long 
run favor compliance and disclosure. Nothing in the proposed rule 
requires administration of ``Miranda'' warnings. The rule does not 
place contractors in the role of law enforcement officers. With regard 
to the concerns about labor agreements, contractors can find ways to 
disclose without violating labor union provisions that protect 
individual privacy of workers.
    v. Cooperative atmosphere more effective. According to one 
respondent, voluntary disclosure fosters a cooperative environment and 
rewards contractors that adopt effective internal controls. Another 
respondent considered that it is a key principle to promote self-
governance as the preferred model to ensure compliance. This respondent 
quoted the Packard Commission findings in June 1986 that self-
governance is the most promising mechanism to foster improved contract 
compliance. Self-governance makes the difference between responsibility 
for compliance and a mere facade of compliance. This respondent 
concluded that, based on 20 years of experience, both scholars and 
industry leaders believe that the current system of voluntary 
disclosure encourages companies to develop a stronger culture while 
still affording the Government broad remedies to protect the 
Government's interests. Under mandatory disclosure, contractors may 
focus on the ambiguities of the letter of the rule rather than the 
spirit of mutual commitment. One respondent expressed long standing 
support for and experience with voluntary self-reporting. It is 
concerned that mandatory self-reporting could discourage partnerships 
with the Government. One respondent cited the ``fundamental principle'' 
that contractor compliance programs resulting from internal company 
commitments to ethical behavior are more likely to be effective in 
preventing illegal behavior than programs imposed by ``overbearing 
regulations.''
    Response: The Councils disagree. See ``Is voluntary disclosure 
working?'' at paragraph B.3.a.ii.
    vi. Incentives. Several respondents contended that existing 
Government programs and contractor initiatives offer ample incentives 
for contractors to voluntarily report procurement violations.
     Several respondents pointed out that contractors may 
receive favorable consideration in debarment proceedings if they have 
voluntarily disclosed the conduct in question.
     Several respondents cited the civil FCA, which provides 
contractors with an incentive to report potentially fraudulent 
behavior. Organizations will voluntarily disclose to avoid lengthy and 
costly whistleblower litigation (qui tam actions). According to several 
respondents, voluntary disclosure can undermine a court's jurisdiction 
to entertain future qui tam cases and can mean the difference between 
maximum and reduced penalties.
     Several respondents also addressed the reduced penalties 
under the guidelines of the USSG, adopted in 1991, which are predicated 
on a model of rewarding voluntary reports. Two respondents stated that 
the proposed rule is inconsistent with the favorable treatment of 
voluntary disclosures under the USSG.
     Respondents cited the Deputy Attorney General's January 
20, 2003, memorandum, ``Principles of Federal Prosecution of Business 
Organizations,'' which provides to Federal prosecutors guidance 
governing charging decisions with respect to corporations and 
sentencing. Several respondents also cited Deputy Attorney General Paul 
J. McNulty's memorandum of December 12, 2006, which demonstrated that 
the DoJ considers an organization's voluntary disclosure and 
cooperation in determining whether to bring charges.
    Various respondents were concerned that the proposed rule may 
eliminate the ability of a contractor to claim the benefit of ``timely 
and voluntary disclosure'' to the Government. One respondent 
recommended that, if the rule is finalized, a contractor should not be 
precluded from seeking and receiving leniency because a disclosure is 
made in compliance with the rule. One respondent stated that the 
proposed rule is not more consistent with the USSG, but actually 
contradicts them.
    One respondent stated that the Councils must consider these 
concerns and evaluate the extent to which eliminating incentives to 
voluntary disclosure will affect a contractor's decision to disclose 
underlying behavior. The respondent believed that

[[Page 67073]]

eliminating incentives could cause contractors to adopt a protective 
posture in the face of evidence of potential criminal behavior.
    Another respondent suggested that, instead of mandating compliance 
and ethics programs, the Councils should open a new FAR case to develop 
an incentive-based approach. This respondent was concerned that the 
logic of penalizing contractors for failure to disclose a crime, rather 
than offering incentives, will not work. The disclosure obligation 
applies only if a crime has already occurred. If there is already a 
crime, then the company is already subject to punishment. Failure to 
disclose will only be an aggravating factor. So, if a company fails to 
disclose, it may escape punishment, but if it discloses, it will likely 
still be subject to punishment for the crime committed. Therefore, 
punishment for failure to disclose may not be sufficient incentive to 
disclose.
    Response: There is nothing in this rule that removes any of the 
existing incentives. The incentives in the FAR (FAR 9.406-1(a)) and the 
USSG are not limited to ``voluntary'' disclosures but to 
``disclosures.'' Even if disclosure is ``mandatory,'' incentives will 
still be offered to promote compliance.
b. Vagueness of Rule
    i. ``Reasonable grounds to believe.'' Numerous respondents were 
concerned that the rule does not specify what constitutes ``reasonable 
grounds.'' One respondent stated that ``reasonable grounds'' is subject 
to varying interpretations, and may be viewed as an even lower standard 
than ``probable cause.'' Should the contractor report based on mere 
suspicion or based on evidence that criminal activity has occurred? 
Because of this lack of clarity, several respondents were concerned 
that companies may tie up Government resources with a mountain of 
meaningless legal trivia. Numerous respondents stated that there will 
be substantial over-reporting because contractors may report even 
remotely possible criminal conduct out of an abundance of caution. One 
respondent considered that this will raise company costs through the 
investigation of baseless claims and incidents. Several other 
respondents stated that there will be an enormous amount of time spent 
sorting out the true criminal activity and truly significant problems.
    One respondent suggested that the proposed rule will potentially 
subject an employer to civil actions brought by an employee when the 
reports forwarded by the employer to the Federal Government (because 
conceivably ``reasonable grounds'' existed) ultimately are determined 
to lack merit.
    Response: The Councils have replaced ``reasonable grounds to 
believe'' with ``credible evidence.'' DoJ Criminal Division recommended 
use of this standard after discussions with industry representatives. 
This term indicates a higher standard, implying that the