Insight Center: Publications

A Roadmap to Requirements for Codes of Business Ethics and Conduct

Government Contracts Update

Authors: Stanley R. Soya and Michael A. Hordell


The U.S. government has imposed on nearly every government prime contractor and subcontractor new mandatory disclosure requirements and specific requirements for Codes of Business Ethics and Conduct. All government contractors need to understand these new far-reaching requirements. Contractors should, where necessary, implement new policies and practices to meet the requirements. Contractors with existing Codes of Business Ethics and Conduct and disclosure policies should review their policies and practices and enhance them where necessary to meet the new criteria.

This article provides a roadmap to the new requirements and some of the more central issues that contractors will need to address. This update expands upon and replaces our December 1, 2008 update that provided notice of the newly issued final regulations that imposed mandatory disclosure and code of business ethics and conduct requirements on government contractors.

The summary discussions provided in this update cannot address every requirement or issue a contractor may face. Contractors need to become familiar with the actual regulatory requirements and the 26-page commentary from the FAR Councils that accompanied the issuance of the Final Regulations in the Federal Register. 73 Fed. Reg. 67064 (Nov. 12, 2008).

Do the New Requirements Apply to You?

All contractors, including small business and commercial item contractors and contractors that perform contracts outside the United States, that are awarded a contract for which the value is expected to exceed $5 million and the performance of which will be 120 days or more, are required to have a Code of Business Ethics and Conduct within 30 days after the contract award (or longer if the contracting officer agrees). FAR 52.203-13(b). Each contractor also is required to promote and maintain a company culture encouraging ethical conduct and a commitment to follow the law. An element of this culture is the "exercise of due diligence to prevent and detect criminal conduct." If during the award, performance or closeout of a contract, a contractor becomes aware of credible evidence that one of its principals, employees, agents or subcontractors has committed a crime involving fraud, conflict of interest, bribery or gratuity violations, or has violated the Civil False Claims Act, it must, in writing, timely disclose this evidence to the procuring agency’s Office of the Inspector General and the agency’s contracting officer.

All contractors awarded a contract that exceeds the $5 million value and 120-day performance period standard noted above, except for small business and commercial item contractors, also are required to have in place a business ethics awareness and compliance program, an internal control system, a periodic review procedure and an internal reporting mechanism within 90 days of contract award (or longer if the Contracting Officer agrees). FAR 52.203-13(c). These requirements include provisions for the contractor to impose appropriate disciplinary action, to make the necessary timely disclosures and to be able to fully cooperate with the government.

All contractors covered by these new requirements must ensure that their subcontracts of a value more than $5 million and with a performance period exceeding 120 days, contain a clause that includes the substance of clause FAR 52.203-13. FAR 52.203-13(d). This clause will ensure that the new requirements described above flow down to any subcontractors.

While small business and commercial item contractors are exempt from the latter ethics and compliance program and internal control requirements, a contractor in this category should determine how it could demonstrate compliance with the mandatory disclosure requirement, even without being required to create a formal compliance program and an internal control system. In other words, the new regulation certainly should be viewed as a roadmap to the requirements that all contractors need to consider in assessing whether their culture encourages and promotes ethical conduct and whether they are exercising appropriate due diligence to prevent and detect criminal conduct.

What are the Mandatory Disclosure Requirements?

What Must Be Disclosed?

Under the new rules, covered contractors must disclose in writing to the appropriate Office of Inspector General and contracting officer when the contractor has credible evidence that a principal, employee, agent or subcontractor of the contractor has committed:

(A) a violation of federal criminal law involving fraud, conflict of interest, bribery or gratuity violations found in Title 18 of the United States Code; or

(B) a violation of the Civil False Claims Act
(31 U.S.C. §§ 3729-3733).

In addition, any contractor that becomes aware that the government has overpaid a contract financing or invoice payment must disclose this to the appropriate contracting officer and remit the overpayment amount to the government. FAR 52.212-4(i)(5), 52.232-25(d), 52.232-26(c) and 52.232-27(1). The knowing failure of a principal to timely disclose credible evidence of a violation or significant overpayment other than an overpayment resulting from a contract financing payment may result in suspension or debarment of the contractor.

What Is ‘Credible Evidence?’

Neither the new FAR provisions nor the FAR Councils’ commentary define credible evidence. In finalizing the new regulations, the FAR Councils replaced the proposed "reasonable grounds to believe" standard with the term "credible evidence." The commentary to the regulation indicates that this term indicates a higher standard, implying that the contractor will have time to determine the evidence’s credibility before deciding whether to disclose it to the government. Fed. Reg. 67073. The councils’ commentary also states that "using the standard of ‘credible evidence’ rather than ‘reasonable grounds to believe’ will help to clarify ‘timely’ [disclosure] because it implies that the contractor will have the opportunity to take some time for preliminary examination of the evidence to determine its credibility before deciding to disclose to the government. Until the contractor has determined the evidence to be credible, there can be no ‘knowing failure to timely disclose.’"

The FAR Councils’ discussion of the requirement to disclose False Claims Act (FCA) violations also sought to provide clarification of the "credible evidence" standard. In this regard, the Councils recognized that some issues concerning the proper application of the civil FCA remain unsettled and subject to further judicial interpretation, and said genuine disputes over proper application of the FCA may be considered in evaluating whether a contractor knowingly failed to disclose a violation. The Councils also noted that merely filing an FCA qui tam action is not sufficient to establish a violation under the statute, nor does it represent, standing alone, credible evidence of a violation. Similarly, the government’s decision not to intervene in an FCA qui tam action is not dispositive of whether the contractor has credible evidence of an FCA violation. Fed. Reg. 67081.

While the FAR Councils comments are intended to clarify that contractors are not required to report mere suspicions or allegations, recent industry outreach meetings with government officials responsible for implementing or writing the new rule indicate that "credible evidence," like beauty, is in the eye of the beholder. As a result, it is more critical than ever for contractors to carefully examine and document how they address possible violations or overpayments.

Is Disclosure of Conduct Before December 12, 2008 Required?

The new suspension/debarment provisions effectively create a three-year look-back disclosure requirement, if any principal of the contractor has knowledge of credible evidence of a violation or overpayment in connection with any contract for which final payment was received after December 12, 2005.

The commentary addressing the mandatory disclosure requirement in FAR 52.203-13 and the clause itself state that reportable violations are "limited to the contract containing the clause." Fed. Reg. 67073. However, the new suspension/debarment provisions require contractors to timely disclose credible evidence of violations or overpayments in connection with the award, performance or closeout of any of its government contracts or a subcontract thereunder, until three years after final payment. Under this requirement, contractors must disclose violations or overpayments in connection with any contract under which final payment was received after December 12, 2005, so any contractor that has had internal control and reporting mechanisms in place should re-examine any reports of possible violations in connection with any contract for which final payment has not been received or was received after December 12, 2005. Contractors also should identify those personnel who are considered "principals" under the new regulation and consider appropriate ways to determine whether these people have knowledge of any reportable violation or overpayment.

What are the Code of Business Ethics and Conduct Requirements?

FAR 52.203-13 requires that each contractor, within 30 days of contract award, have a "written code of business ethics and conduct" and "make a copy of the code available to each employee engaged in performance of the contract." FAR 52.203-13(b)(1)(i) and (ii). The drafters of the requirements have left it to each contractor to determine the code content.

Whether a company has a code or is creating one, several universal factors should be considered and included to ensure the adequacy and sufficiency of the code. Initially, the code must be consistent with the company’s size and operations. The code should be tailored to meet the needs and values of the organization. Companies creating a code for the first time can gain helpful insights from the experience and best practices of companies that already have implemented effective codes. For example, codes founded upon ethical principles and values are more accepted and effective than codes that merely repeat detailed requirements of laws or regulations. Involving employees in creation of the code likewise increases acceptance. In addition, if the code will apply to foreign operations, translating it into appropriate languages and tailoring it as necessary to reduce any U.S.-centric focus also will increase acceptance. Finally, it is imperative that upper-level management accept all standards and procedures addressed in the code, since complete buy-in is critical for successful implementation of the code.

More specifically, the code, at a minimum, must address the issues raised in the revised clause. Those issues essentially concern fraud, conflict of interest, bribery, gratuities, kickbacks, false claims, mischarging, overcharging and notification mechanisms (both internally and to the government) of possible violations. The code also should ensure the "exercise [of] due diligence to prevent and detect criminal conduct; and, otherwise promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law." FAR 52.203-13(b)(2)(i) and (ii). Obviously, companies that have an existing code should determine how best to revise the code to make the transition to the "new" code smoother and less costly than a complete code re-write.

What Are the Requirements for Business Ethics Awareness and Compliance Program and Internal Controls?

The requirements for contractors to implement a Business Ethics Awareness and Compliance Program and Internal Controls are based upon, but do not adopt verbatim, the elements for an effective ethics and compliance program under the U.S. Sentencing Guidelines (USSG). Consequently, companies that have established ethics and compliance programs and internal controls that meet all of the USSG elements may find that their programs require only a few enhancements to meet the new FAR requirements. Companies that establish a program for the first time will face a more extensive effort and should not wait until the award of their first contract containing the new requirements to begin establishing and implementing such a program. The regulations provide a baseline framework for the establishment of a Business Ethics Awareness and Compliance Program and Internal Controls. Contractors must ultimately determine the most effective way to implement these requirements.

The new regulations make clear that the program must be ongoing. Merely disseminating a boilerplate Code of Business Ethics and Conduct and forgetting about it will not be sufficient. Contractors are expected to take reasonable steps to periodically and in a practical way communicate their standards and procedures by: conducting effective training programs; providing such training to the contractor’s principals and employees, and as appropriate, to subcontractors; and otherwise disseminating information appropriate to each individual’s roles and responsibilities.

The contractor’s Internal Control System must establish standards and procedures to facilitate timely discovery of improper conduct in connection with government contracts and must ensure that corrective measures are promptly carried out. To meet these broad requirements, contractors must assign responsibility for the program at a sufficiently high level and provide adequate resources to ensure the program’s effectiveness. Contractors will need to assess their human resources processes for hiring, evaluating and promoting to ensure that they meet the requirement to take reasonable efforts not to include an individual as a principal, whom due diligence would have exposed as having engaged in conduct that conflicts with the contractor’s Code of Business Ethics and Conduct. Contractors also are required to take appropriate disciplinary action for improper conduct or failure to prevent or detect improper conduct.

The contractor’s program must include periodic reviews of its business practices, procedures, policies and internal controls for compliance with the contractor’s code and requirements for government contracting. These reviews must assess the risk of criminal conduct; monitor and audit to detect criminal conduct; and take appropriate steps to design, implement or modify the program to reduce such risk.

Finally, the contractor must have an internal reporting mechanism, such as a hotline, which allows anonymity or confidentiality, by which employees may report suspected instances of improper conduct, and instructions that encourage such reports. While the regulations indicate that contractors can use a government hotline and informational poster to meet this requirement, abdicating such an important element of the program to the government is not generally the most effective way for a contractor to establish an ongoing effective program. Establishing a "Help Line" that gives employees an opportunity to raise questions, obtain guidance and make reports without fear of retaliation, is generally recognized as an effective way to identify and address potential problems early, either before they occur or become larger problems.


As government agencies implement their own policies and practices to address these requirements, new issues will inevitably arise. Our attorneys have assisted clients in establishing and implementing effective Business Ethics and Compliance Programs and Internal Controls for more than 20 years, beginning with the earliest industry voluntary initiatives in the mid-1980s. We can address the ramifications of the new requirements and provide an in-depth review of your ethics, compliance and internal control systems to assist you in determining what changes may be needed to comply with the new requirements and still operate your business efficiently and productively.

Michael A. Hordell and Stanley R. Soya

The material in this publication is based on laws, court decisions, administrative rulings and congressional materials, and should not be construed as legal advice or legal opinions on specific facts. The information in this publication is not intended to create, and the transmission and receipt of it does not constitute, a lawyer-client relationship.