Compliance Developments Jeff Newman

Overview  A continued (and increased) focus on compliance  Recent developments ⁻Industry-by-industry coverage  Development of a code of conduct and internal controls  Key implementation steps 2

Industry Update  Pharma  IT  Education  Defense & Security  Financial 3

Development of a Code of Conduct and Internal Controls  FAR Clause and revisions to FAR Subpart 9.4 require formal compliance programs. ⁻FAR applies to prime contracts & subcontracts > $5 million (base + options)/performance 120 days+. ⁻Requirement must be flowed down in all subcontracts that exceed $5 million and whose performance period is greater than 120 days. 4

Development of a Code of Conduct and Internal Controls  FAR Subpart 9.4 applies to all contracts and subcontracts, regardless of type, size or duration, and has a three-year “look back” provision  FAR requires: ⁻Written Code of Business Ethics and Conduct (Code) implemented and available to each employee engaged in the contract within 30 days after contract award. 5

Development of a Code of Conduct and Internal Controls ⁻Awareness Program and Internal Control System (for non-small businesses and non-commercial item contracts) established within 90 days after contract award  As a practical matter, all contractors need internal control mechanisms because FAR Subpart 9.4 now includes, as a basis for suspension and debarment, a “knowing failure” by a principal to timely disclose.... 6

Key Implementation Steps  Take the appropriate steps NOW ⁻Where is your Code? ⁻Ensure that the components of your Code are suitable to the size of the company and extent of its involvement in government contracting. ⁻Evaluate and incorporate the appropriate internal controls into your Code. 7

Key Implementation Steps  Maintaining effective compliance practices ⁻Contracting 101… ⁻Tone from the top ⁻Training ⁻Compliance should be more than avoiding unlawful conduct … compliance should extend to all aspects and avenues of government contracting practices. 8

Key Implementation Steps  Take advantage of audits, mini-audits or periodic reviews  Some initial steps: ⁻Establish audit team Contractor performed or outsourced reviews/audits should be performed by “detached” evaluators, e.g., principal investigators under a R&D contract should not be performing the only, or formal, corporate compliance audit/evaluation. ⁻Define scope of audit and objectives to be achieved (e.g., areas to cover and “visions” of company compliance) ⁻Develop deliverables (e.g., matrix of problem areas and related risk rating) 9

Key Implementation Steps  Conducting the audit – top-level steps: ⁻Paper and personnel (and welcome to the 21 st century) ⁻Honest assessment ⁻Random sampling ⁻Toot your horn! ⁻Final deliverable and recommendations 10