Government contractors face new compliance obligations and potential mandatory disclosure requirements

January 07, 2008

Government Contracts Alert

Author(s): Brian K. French

In the final weeks of 2007, the federal government amended the Federal Acquisition Regulation (“FAR”) to impose new compliance obligations on government contractors. Under the new FAR rule, which became effective on December 24, 2007, contractors must adopt written codes of conduct and implement internal compliance control systems. In addition, the government is also considering a further amendment to the FAR, which would subject contractors to mandatory disclosure requirements and compel “full cooperation” with government investigators. The comment period for this proposed rule ends on January 14, 2008.

By Brian K. French and Jacob B. Pankowski

The new FAR rule

On November 23, 2007, the Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council (the Councils) issued a new FAR rule requiring contractor codes of business ethics and conduct and related compliance programs.[1] The new regulation applies to contracts that are expected to exceed $5 million in value and have performance periods of 120 days or more. It does not apply to commercial item contracts or to contracts performed entirely outside the United States. Nixon Peabody published a prior alert discussing the proposed rule that, in large part, has now become part of the final rule. See “New Proposed Rule Could Impose New Procurement Integrity Requirements,” available at

Under the new rule, a covered contractor must have a written code of business ethics and conduct within 30 days after the award of a covered contract. Unless the contractor is a small business, it must also, within 90 days after contract award, establish an ongoing business ethics and conduct awareness program and an internal control system that will facilitate the discovery of improper conduct and ensure that corrective measures are promptly instituted.

The new regulation includes flowdown provisions that subject subcontractors to the same compliance obligations as prime contractors. A contractor is not required to monitor the ethics awareness programs and internal control systems of its subcontractors, but must nevertheless “check” for the existence of those programs.

Finally, contractors must display fraud hotline posters if the contract exceeds $5 million and is with an agency that has a hotline poster or is funded with disaster assistance funds. Except for contracts funded with disaster assistance monies, contractors need not display agency hotline posters if they have implemented a business ethics and conduct awareness program that includes a fraud reporting mechanism.

The proposed FAR amendments

On November 14, 2007, at the request of the U.S. Department of Justice (DOJ), the Councils proposed an additional FAR amendment that could dramatically change the way in which government contractors handle information about possible wrongdoing within their organizations.[2] Like the Final Rule, the proposed regulation would apply to contracts in excess of $5 million and with performance periods of 120 days or more. It would not apply to commercial item contracts or to contracts performed entirely outside the United States.

DOJ’s proposed rule would modify FAR’s new section on contractor codes of business ethics and conduct to mirror those provisions of the U.S. Sentencing Guidelines for Organizations that identify the elements of an “effective” compliance program. More significantly, the proposed rule would require contractors to notify the government in writing “whenever the Contractor has reasonable grounds to believe that a principal, employee, agent, or subcontractor of the Contractor has committed a violation of [f]ederal criminal law in connection with the award or performance of [the] contract or any subcontract thereunder.” Contractors could be suspended or debarred for a “[k]nowing failure to timely disclose” a criminal violation or an overpayment on a government contract. In addition, the proposed rule would obligate contractors to provide “[f]ull cooperation with any [g]overnment agencies responsible for audit, investigation, or corrective actions.”

As discussed below, the combination of mandatory disclosure and full cooperation requirements raises a number of troubling issues.

Mandatory disclosure and full cooperation


For decades, voluntary cooperation and self-disclosure have been central to the way in which corporations, government agencies, and federal prosecutors approach possible criminal activity within an organization. Of particular relevance to government contractors, in the wake of reported defense spending waste and contractor fraud in the mid-1980s, President Reagan established the so-called “Packard Commission” to recommend reforms for the defense procurement system.[3] The Packard Commission recommended the establishment of ethics codes within the defense contracting industry and a program to govern voluntary disclosure of contractor misconduct to the Department of Defense (DOD).[4] In 1986, largely in response to the Packard Commission’s recommendations, but also on their own initiative, a number of major defense contractors drafted the “Defense Industry Initiatives on Business Ethics and Conduct” (DII). A key principle of DII is that each signatory company “has the obligation to self-govern by monitoring compliance with federal procurement laws and adopting procedures for voluntary disclosure of violations of federal procurement laws and of corrective actions taken.”[5] That same year, DOD adopted a Voluntary Disclosure Program to encourage internal investigations and early reporting of illegal activity by defense contractors in exchange for the possibility of more lenient treatment.[6]

In 1991, the U.S. Sentencing Commission adopted the Sentencing Guidelines for Organizations (the Guidelines), which incorporated the concept of voluntary corporate self-policing. According to members of the Sentencing Commission, the main goal of the Guidelines is not punishment, but rather, “the promotion of good corporate citizenship through encouraging implementation of effective compliance programs, which – it is hoped – will prevent crime.”[7] Under the Guidelines, a corporation may receive a reduction in its “culpability score” if, “prior to an imminent threat of disclosure or government investigation … and … within a reasonably prompt time after becoming aware of the offense, [the corporation] reported the offense to appropriate governmental authorities.”[8] The Guidelines are based on a “carrot and stick” approach to corporate crime, in which companies that fail to take certain actions, such as establishing strong compliance programs, voluntarily disclosing misconduct, and fully cooperating in government investigations, face harsh penalties, while companies that voluntarily take such measures may avoid onerous sanctions.[9]

Voluntary cooperation and self-disclosure also have become important variables in the charging decisions made by federal prosecutors. In 1999, then-Deputy Attorney General Eric H. Holder issued a policy memorandum entitled “Federal Prosecution of Corporations” (the Holder Memorandum), which was intended to guide prosecutors in deciding whether to charge a corporation with a crime.[10] The Holder Memorandum provided that, in making their charging decisions, prosecutors should consider “[t]he corporation’s timely and voluntary disclosure of wrongdoing and its willingness to cooperate in the investigation of its agents.” In December 2006, then-Deputy Attorney General Paul J. McNulty issued a memorandum (the McNulty Memorandum) that revised the charging guidelines to require prosecutors to consider a company’s voluntary cooperation and disclosure in deciding whether to charge an organization.[11]

Mandatory disclosure and compelled cooperation are bad ideas

In support of its proposed rule, DOJ has claimed that mandatory disclosure is necessary because few companies have responded to DOD’s invitation to voluntarily report suspected criminal activity. This seems to imply that criminal behavior among contractors is going unreported and unaddressed and that other explanations for the reportedly low levels of participation in the Voluntary Disclosure Program do not exist.

In 1996, the U.S. Government Accountability Office (GAO) observed that, while many of the top defense contractors had made voluntary disclosures since the inception of the program, the total number of disclosures was still relatively small.[12] Although GAO failed to opine on why more companies had not taken advantage of the program, it noted that voluntary disclosures to DOD took an average of 2.8 years to complete, with roughly 25 percent taking more than four years, and that case management was a low priority for the investigative agencies.[13] More recently, DII acknowledged that the number of reports to DOD under the Voluntary Disclosure Program has diminished over the past few years. However, according to DII, this decrease is explained by “[l]ess emphasis by [DOD]; fewer reportable instances; more issues being resolved under the contract as contract issues, rather than as ‘criminal’ issues; industry perception that the government is slow in processing disclosures; [and] concern that there is no restriction on the use of a disclosure report in criminal, civil or administrative actions against individuals.”[14] It is believed that most instances of misconduct in connection with government contracts are resolved informally through reports to contracting officers and contract administrators.

In any event, regardless of DOJ’s justification for its proposed rule, there are a number of reasons why mandatory disclosure and full cooperation requirements would be detrimental to both contractors and the government:

  • For decades, corporate criminal procedure has been based on the notion that good corporate citizenship is best achieved through voluntary self-policing and voluntary disclosure. Mandatory disclosure and compelled cooperation are inimical to these principles and could undermine the many corporate compliance programs that are structured around the concept of voluntary self-policing.
  • It is unclear whether the incentives for self-reporting, including the possibility of avoiding criminal charges and receiving lesser sanctions, would remain available to contractors, whose disclosures might no longer be deemed “voluntary” under the proposed rule. Without these incentives, some contractors might decide to keep information to themselves rather than expose the company to unmitigated sanctions.
  • Whether a contractor has “reasonable grounds to believe” that a principal, agent, employee, or subcontractor has committed a crime in connection with a government contract is a highly ambiguous standard. Courts and commentators have often recognized the difficulty of knowing whether certain conduct constitutes a crime. Indeed, one commentator has stated that, “[i]n some cases, neither prosecutors nor courts know whether the conduct at issue is encompassed by the criminal law.”[15] In light of this uncertainty, contractors may find themselves at greater risk of suspension or debarment for failure to timely disclose marginal conduct that is later determined to be criminal. Conversely, to avoid these sanctions, some contractors may err on the side of reporting what actually is not criminal conduct, resulting in unnecessary investigations and considerable costs.
  • Mandatory “full cooperation” raises serious concerns about whether waiver of the attorney-client privilege and work product protections would be necessary. Although it is generally more difficult today for federal prosecutors to extract privilege waivers from corporations as a condition to finding that the company provided sufficient cooperation to the government,[16] many companies still feel pressure to waive privileges to demonstrate cooperation and avoid more onerous sanctions. For instance, the McNulty Memorandum provides that prosecutors may not consider a corporation’s refusal to waive the attorney-client or work product protections in making a charging decision, but they “may always favorably consider a corporation’s acquiescence to the government’s waiver request in determining whether a corporation has cooperated in the government’s investigation.”[17] The already existing pressures to waive privileges can only be exacerbated by a rule that compels full cooperation.
  • Knowing that their employers could be required to disclose any information they provide to the government, employees may be less inclined to cooperate with internal investigations. Moreover, the combined requirements of mandatory disclosure and full cooperation could implicate employees’ constitutional rights against self-incrimination when they are interviewed by company counsel as part of an internal investigation that is effectively conducted at the government’s behest.[18]

Nixon Peabody is preparing formal comments on the proposed rule, which must be submitted to the FAR Secretariat on or before January 14, 2008. Interested parties should contact the attorneys listed above with any questions or input they would like to provide.

  1. FAR Case 2006-007, Contractor Code of Business Ethics and Conduct, 72 Fed. Reg. 65,873 (Nov. 23, 2007).
    [Back to reference]
  2. FAR Case 2007-006, Contractor Compliance Program and Integrity Reporting, 72 Fed. Reg. 64,019 (Nov. 14, 2007).
    [Back to reference]
  3. Benjamin B. Klubes, “The Department of Defense Voluntary Disclosure System,” Public Contract Law Journal 19:504, 507–08 (1989); Charles J. Walsh & Alissa Pyrich, “Corporate Compliance Programs as a Defense to Criminal Liability: Can A Corporation Save Its Soul?” Rutgers Law Review, 47:605, 6655–56 (1995); Christopher A. Wray and Robert K. Hur, American Criminal Law Review 43:1095, 1115–17 (2006).
    [Back to reference]
  4. Id.
    [Back to reference]
  5. “Defense Industry Initiative on Business Ethics and Conduct,” 2006 Annual Public Accountability Report, 7–11, 49 (January 2007), available at
    [Back to reference]
  6. Id. at 49.
    [Back to reference]
  7. Diana E. Murphy, “The Federal Sentencing Guidelines for Organizations: A Decade of Promoting Compliance and Ethics,” Iowa Law Review 87:697, 706 (2002).
    [Back to reference]
  8. U.S. Sentencing Guidelines Manual, § 8C2.5(g).
    [Back to reference]
  9. Win Swenson, “The Organizational Guidelines’ ‘Carrot and Stick’ Philosophy, and Their Focus on ‘Effective’ Compliance” (Sept. 7, 1995), in U.S. Sentencing Comm’n, Corporate Crime in America: Strengthening the “Good Citizen” Corporation (1995), at 24, available at
    [Back to reference]
  10. See memorandum from Deputy Attorney General Eric Holder to all component heads and United States attorneys, dated June 16, 1999, available at
    [Back to reference]
  11. Memorandum from Deputy Attorney General Paul J. McNulty to heads of department components, United States attorneys, dated December 12, 2006, at 4, available at
    [Back to reference]
  12. United States General Accounting Office, DOD Procurement: Use and Administration of DOD’s Voluntary Disclosure Program, GAO/NSIAD-96-21, at 1 (February 1996).
    [Back to reference]
  13. Id. at 8, 11.
    [Back to reference]
  14. DII, 2006 Annual Public Accountability Report, supra, at note 5, at 49-50.
    [Back to reference]
  15. Geraldine Szott Moohr, “Prosecutorial Power in an Adversarial System: Lessons from Current White Collar Cases and the Inquisitorial Model,” Buffalo Criminal Law Review 8:165, 180 (2004). See also William J. Stuntz, “Self-Defeating Crimes,” Virginia Law Review 86:1871, 1883 (2000); Lisa Kern Griffin, “Compelled Cooperation and the New Corporate Criminal Procedure,” New York University Law Review 82:311, 340 (2007).
    [Back to reference]
  16. Under the Guidelines, a corporation may receive a reduction in its culpability score by voluntarily reporting wrongdoing to the government and fully cooperating in the investigation. The Guidelines previously stated that waiver of the attorney-client privilege and work product protections was “not a pre-requisite to a reduction in culpability score … unless such a waiver [was] necessary in order to provide timely and thorough disclosure of all pertinent information known to the organization.” U.S. Sentencing Guidelines Manual § 8C2.5(g), effective Nov. 1, 2004. This waiver language was deleted from the Guidelines as of November 2006. See “Notice of Submission to Congress of Amendments to the Sentencing Guidelines Effective November 1, 2006,” 71 Fed. Reg. 28,063-01 (proposed May 15, 2006), available at On December 12, 2006, Deputy Attorney General McNulty issued the so-called “McNulty Memorandum,” in which he stated that federal prosecutors may only request waivers of the attorney-client or work product protections when there is a “legitimate need” for the privileged information and only after they obtain written approval from the United States Attorney for the particular district or from the Deputy Attorney General, depending on the nature of the information requested. See memorandum from Deputy Attorney General Paul J. McNulty, supra, note 11, at 9–10.
    [Back to reference]
  17. Memorandum from Deputy Attorney General Paul J. McNulty, supra, note 11, at 10.
    [Back to reference]
  18. See Lisa Kern Griffin, supra, note 15, at 352–78 (arguing that the Fifth Amendment should afford employees some protection against coerced disclosures, even when an agent of the corporation poses the questions).
    [Back to reference]

The foregoing has been prepared for the general information of clients and friends of the firm. It is not meant to provide legal advice with respect to any specific matter and should not be acted upon without professional counsel. If you have any questions or require any further information regarding these or other related matters, please contact your regular Nixon Peabody LLP representative. This material may be considered advertising under certain rules of professional conduct.

Back to top