1. New FAR Rules on Mandatory Disclosure and Contractor Business Ethics Richard P. Rector Chair, Government Contracts Practice DLA Piper LLP (US) © 2009 DLA Piper LLP (US) – All Rights Reserved

2. Agenda Background of New FAR Rules Overview of Final Rule: Mandatory Disclosure Overview of Final Rule: Compliance Programs Specific Disclosure Requirements: Suspension/Debarment Specific Disclosure Requirements: Contract Clause/Internal Control System Expanded Requirements for Internal Control Systems Potential Contractor Actions

3. Background of New FAR Rules December 2007: Final Rule on Contractor Business Ethics –In December 2007, US government created mandatory requirements for contractor Codes of Conduct, ethics training and internal control systems Applicable to contracts over $5 million and 120 days in duration Not applicable to commercial-item contracts and contracts performed entirely overseas... portions not applicable to small businesses Effective December 24, 2007 … implemented in FAR Subpart 3.10 Many large contractors had compliance programs and systems that met requirements … principal impact was on mid-sized and small contractors

4. Background of New FAR Rules 2007/2008: Proposed FAR Rules on Mandatory Disclosure –In separate rules (Nov. 2007 and May 2008), government proposed “mandatory disclosure” of federal criminal violations Implemented through further changes to FAR Subpart 3.10 and related FAR parts Would replace “voluntary disclosure” system in place since mid-80s … significant change for all federal contractors Change suggested by DoJ … policy of voluntary disclosure was allegedly ignored by contractors for past 10 years Significant pushback from industry on need for change, as well as scope and application of proposed rule In May 2008, proposed rule was expanded to require disclosure of federal criminal violations and civil False Claims Act (FCA) violations

5. Background of New FAR Rules Mid-2008: Legislation on Mandatory Disclosure –In June 2008, Congress weighed in with the “Close the Contractor Fraud Loophole Act”... required revision of FAR within 120 days –Enacted as part of the Supplemental Appropriations Act (Pub. L. 110-252, Title VI, Chapter 1) –Required mandatory disclosure of violations of federal criminal law and overpayments to contractors No requirement for disclosing civil FCA violations –Implicitly required extension of portions of FAR 3.10 to commercial-item contracts and contracts performed outside US November 2008: Final Rule on Mandatory Disclosure and Contractor Business Ethics –Issued November 12, 2008 (73 Fed. Reg. 67,064)... lengthy “Preamble” –Became effective December 12, 2008 –Final word on mandatory disclosure … requires immediate attention from federal contractors –Also includes expanded requirements for contractor compliance programs

6. Overview of Final Rule: Mandatory Disclosure Acknowledged by US government as a “sea change” and “major departure” from existing practice New Rule sets forth three separate requirements for mandatory disclosure: –Disclosure required to avoid suspension or debarment – FAR 3.1003(a)(2), (3) –Disclosure required by contract clause -- FAR 52.203-13(b)(3) –Disclosure required by internal control system -- FAR 52.203-13(c)(2)(ii)(F) Disclosure obligations under each requirement are similar, but not identical Suspension/debarment disclosure obligation is most critical –Requires broadest disclosures –Took immediate effect on December 12, 2008, applying to all federal contractors, regardless of contract value or duration Best practice: Modify compliance system to meet the suspension/debarment disclosure obligation immediately

7. Overview of Final Rule: Mandatory Disclosure To avoid suspension/debarment, all federal contractors must disclose: –Violations of certain procurement-related criminal laws –Violations of civil False Claims Act –Significant overpayments to contractor Suspension/debarment disclosure obligation creates an immediate “lookback” requirement for all federal contractors –Obligation became effective on December 12, 2008, and disclosure is required for three years after “final payment” on a contract –Contractors must look back and ask: have all violations and significant overpayments been disclosed on existing contracts? And on contracts closed via final payment within the past three years? –Contractors also must ask: is a previous disclosure to “the government” (rather than to Inspector General and Contracting Officer) sufficient? Best practice: Immediately assess need for disclosures on existing contracts and contracts closed via final payment in last three years … consider documenting bases for assessment … disclose as necessary

8. Overview of Final Rule: Changes To Compliance Programs Previous exemptions in FAR 3.10 for overseas contracts and commercial- item contracts substantially narrowed –No exemption to compliance program requirements for contracts performed entirely overseas –All contracts and subcontracts greater than $5 million and 120 days must include Code of Conduct requirement –Small businesses and commercial-item contracts still exempt from requirements for ethics training/awareness and internal control systems Requirements for training/awareness and internal control systems, if applicable, are more detailed Requirements remain for posting of hotline posters (but not applicable to commercial-item contracts or contracts performed entirely overseas) Definition of “past performance” revised to include contractor’s record of integrity and business ethics … makes integrity an evaluation issue, subject to protest, not just a responsibility issue? Best practice: Design a single compliance program to meet the highest-level requirements applicable on any contract

9. Overview of Final Rule: Compliance Programs FAR requirements for compliance programs are now largely consistent with those of US Federal Sentencing Guidelines, but are not identical –FAR rules are more detailed and include obligations not set forth in the Guidelines (e.g., display of hotline posters, mandatory reporting) –Sentencing Guidelines establish two standards not specifically reflected in FAR Working knowledge and oversight of the compliance program by the highest governing body within the company (e.g., board of directors) Use of incentives for employees to comply with the program Best practice: Design compliance program to meet requirements of both FAR rules and Federal Sentencing Guidelines

10. Specific Disclosure Requirements: Suspension/Debarment Became applicable immediately to all contractors on December 12, 2008, regardless of whether contract clause (FAR 52.203-13) is incorporated into contracts A contractor may be suspended/debarred for … –A knowing failure … –By a principal … –To timely disclose … –To “the government” … –Credible evidence of… A violation of federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the U.S. Code … or A violation of the civil FCA … or A significant overpayment (other than overpayments related to contract financing payments) –In connection with the award, performance, or closeout of contract or a subcontract awarded thereunder Must disclose until 3 years after “final payment” on contract or subcontract Suspension/debarment disclosure obligation only applicable to prime contractors, not subcontractors

11. Specific Disclosure Requirements: Suspension/Debarment Criminal violations restricted to Title 18 procurement laws –Doesn’t address Title 41 violations (e.g., Procurement Integrity Act, Anti-Kickback Act), but violations of these laws could likely be charged as Title 18 offenses … may not be a meaningful restriction Civil FCA Violations –Includes broad range of potential contractual and regulatory violations –Substantially broadens scope of reportable incidents … will likely be most difficult to implement “Credible evidence” –Is not defined and is not a term of art in federal criminal law –Preamble: reflects a higher standard than “reasonable grounds to believe” –Preamble: implies that contractor will have opportunity to take time for preliminary examination of evidence before deciding to disclose to the Government Disclosure required to “the government” rather than specifically to the Inspector General and Contracting Officer –Disclosure to CO alone sufficient to prevent suspension/debarment? –Prior disclosures to CO alone sufficient to meet “lookback” disclosure obligation? “Principal” –Defined as an officer, director, owner or person having primary management or supervisory responsibilities –Intent is to broadly construe … e.g., can include Chief Ethics Officer or Director of Internal Audit “Significant Overpayment” –“Significant” not defined … depends on totality of circumstances –Excludes FAR 32.001 contract financing (e.g., advance payments, performance-based payments, progress payments) Disclosures not released under FOIA w/o notice to contractor

12. Specific Disclosure Requirements: Contract Clause/Internal Control System Applies to covered solicitations and contracts (greater than $5M and 120 days) beginning December 12, 2008 via contract clause (FAR 52.203-13) Contractor must … –Timely disclose in writing... –To agency Office of Inspector General and Contracting Officer... –Whenever the contractor has credible evidence … –That a principal, employee, agent or subcontractor has committed … A violation of federal criminal law involving fraud, conflict of interest, bribery or gratuity violations found in Title 18 of the U.S. Code … or A violation of the civil FCA –In connection with the award, performance or closeout of this contract or any subcontract thereunder Must disclose until 3 years after final payment on contract “Agent” is anyone authorized to act on behalf of company (JV/teaming partners? consultants?) Contractor entitled to equitable adjustment if clause is added to existing contracts or in task/delivery orders?

13. Specific Disclosure Requirements: Contract Clause/Internal Control System Disclosure required to agency Inspector General, with copy to Contracting Officer –If violation relates to more than one contract, disclose to agency with largest contract –If violation relates to an order, disclose to ordering agency and agency responsible for basic contract Criminal violations restricted to Title 18 procurement laws –Overpayments not addressed – but covered separately in suspension/debarment obligation “Credible evidence” standard Contract clause must be flowed down to all subcontracts greater than $5 million and 120 days in duration –No requirement that contractors review or approve subcontractors’ Codes of Conduct or internal control systems –But contractors should verify that a Code and a compliance program exist as part of standard oversight of subcontractors –Contractors should also provide training to subcontractors and agents “as appropriate” –Subcontractors disclose directly to government … disclosure through the prime contractor is not required

14. Expanded Requirements for Internal Control Systems Unless contractor is a small business, or contract is for a commercial item, contractor must have an internal control system that provides: –Adequate resources and assignment of responsibility at sufficiently high level to ensure effectiveness of compliance program –Reasonable diligence to prevent the hiring of a “principal” that has taken actions inconsistent with contractor’s Code (i.e., background check regarding criminal behavior of any type) –Periodic reviews/audits of compliance with Code of Conduct and special requirements of Government contracting –A hotline (with anonymity and confidentiality if desired) and instructions that encourage employees to make reports to hotline –Disciplinary action –Timely disclosure of violations of civil FCA and federal criminal law involving fraud, conflict of interest, bribery or gratuity violations found in Title 18 of the U.S. Code –“Full cooperation” with government agencies responsible for audits, investigations or corrective action

15. Expanded Requirements for Internal Control Systems “Full Cooperation” –Disclosure of information sufficient for law enforcement to identify the nature and extent of the offense, as well as the individuals responsible –It includes providing timely and complete responses to requests for documents and access to employees with information –Reasonable to expect that compliant contractors “will encourage employees both to make themselves available and to cooperate with the government investigation” –Does not require Waiver of attorney/client privilege or work product doctrine Waiver of an individual’s Fifth Amendment right against self-incrimination –Does not prevent a contractor from: Conducting an investigation Defending itself Indemnifying its employees for legal costs (depending on state law)

16. Potential Contractor Actions 1.Address “Lookback” Disclosure Obligation to Avoid Suspension/Debarment (December 2008) –Create “diligence” process to assess need for disclosures on existing contracts and contracts on which final payment was received within past three years –Consider whether prior disclosures were adequate under new rules (disclosure to “government” vs. disclosure to IG and CO) –Protect privilege – “Upjohn” Letter? –Consider documenting process and bases for “lookback” assessment to demonstrate diligence –Make disclosures as necessary to government Online vs. hard-copy disclosure? Minimize written information?

17. Potential Contractor Actions 2.Modify existing compliance program to meet new rules –Ensure that compliance program meets highest-level FAR requirements applicable on any contract, as well as Federal Sentencing Guidelines –Create “diligence” process for reasoned, informed decision making on potential disclosures Investigate: who knew what when? Assess “intent” (knowing, reckless disregard, deliberate ignorance) on all significant contractual and regulatory violations? –Ensure that internal control system and training program address reportable violations and significant overpayments Written procedure? Centralized responsibility for disclosure decisions (e.g., Chief Compliance Officer)? Internal certifications from principals? Examples of fraud and civil FCA violations included in training materials? Reporting by employees incentivized (e.g., performance evaluations)? –Ensure that internal control system meets expanded FAR requirements (e.g., full cooperation, background checks on principals)

18. Potential Contractor Actions 3.Brief board of directors and principals on obligations under new rules and new systems/mechanisms for assuring compliance 4.Consider whether obligation to make mandatory disclosures is a material risk that should be reported in SEC-type filings 5.Assess procedural impacts on internal investigations (e.g., documentation, protection of privilege, employee interviews, indemnity/counsel for employees, protection for whistleblowers) 6.Assess potential qui tam risks and mitigation approaches (e.g., public disclosure) 7.Address teaming/subcontractor management issues -- flowdown of contract clauses? -- training of agents and subcontractors as appropriate? -- diligence regarding subcontractors’ ethics programs? -- consistency of disclosure with subcontract terms on confidentiality and non-disclosure of information? -- flowdown of “full cooperation” standard? 8.Seek prompt closeout and “final payment” on contracts to limit period of exposure 9.Update Human Resources policies regarding hiring and promotion of “principals” (e.g., background checks)