Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

Streamlining and Improving Compliance Volume 3

Recommendation 63: Create a policy of mitigating supply chain and 

performance risk through requirements documents.

Problem

Supply chain risk issues have grown in importance as the U.S. supply base has grown increasingly 

global. The DFARS system was not designed to develop policy; it was designed to deploy and 

implement policy that has already been developed.

Background

Supply chain risk issues have grown in importance as the U.S. supply base has grown ever more 

global. Even a cursory review of open-source media makes clear that rivals and enemies exploit those 

risks. Vulnerabilities to espionage, attack, and political embarrassment will grow in the future, unless 

the United States develops and rapidly implements effective policy countermeasures. The DFARS 

system was designed to implement policy from statute and originated from DoD or other agencies if 

those policies apply to DoD. The DFARS is an ineffective tool when DoD tries to use it to develop 

solutions. It is slow, and it lies in the jurisdiction of the Defense Pricing and Contracting office under 

USD(A&S), which does not have the expertise or authority to drive change in the technical, 

requirements, and program execution communities.

Seeking to understand the effects of FAR and DFARS clauses on DoD’s supply chain, the Section 809 

Panel identified more than 160 FAR and DFARS clauses that include subcontract flow down clauses. 

Not all flow down contract clauses are included in every government procurement or apply to every 

subcontract. Yet clauses are more likely to be over applied to prime contracts and subcontracts due to 

the complexity of determining applicability, especially when applicability is based primarily on the 

risks associated with what is being procured and not risks associated with the business arrangement. 

The volume of contract clauses alone creates a real or perceived barrier to entry for new government 

contractors and subcontractors. Many flow down clauses for which applicability is based on the risks 

associated with what is being procured should be addressed in specific contract requirements or 

statements of work.

Discussion

Numerous contract clauses address subject matter that should be addressed individually in a contract’s 

statement of work or requirements document as opposed to being included in broadly applied contract 

clauses. The substantial volume of contract clauses flowed to prime contractors and subsequently 

throughout the supply chain, is driven, in part, by over application of clauses for which requirements 

were intended to protect the government’s interest. 

One traditional defense contractor explained that nontraditional companies they seek to subcontract 

with will often be handed a subcontract containing all or most of the 160-plus clauses included in the 

prime contract. This situation occurs because the prime contractor is leery to determine a clause does 

not need to be flowed down. On the receiving end, the nontraditional companies do one of three 

things: (a) accept the business opportunity without fully understanding all of the compliance 

requirements, (b) hire lawyers or consultants who can decipher and explain what they must do to meet

all the compliance requirements, or (c) they refuse the subcontract. When companies accept the 

subcontracting opportunity without understanding what all of the clauses require, the risks DoD is 
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

Streamlining and Improving Compliance Volume 3

most interested in managing are lost in the sheer volume of clauses. In the other two situations, 

opportunities are lost because only certain small or innovative nontraditional companies will have the 

capital to expend on lawyers or consultants that can interpret what the contract requires.

Instead of addressing requirements on a contract-by-contract basis, the government has taken a blanket 

approach to requirements, imposing compliance requirements that may not meet the intended purpose 

under the circumstances of the procurement, or may be altogether unnecessary for a particular 

procurement. DoD does not have a system for directing risk mitigation requirements across the 

enterprise, except through the DFARS. Certain organizations within DoD, like the Air Force Installation 

and Mission Support Center, have developed standardized performance work statements for services 

acquired across the agency. In addition, procurement of certain products has been centralized through 

organizations like the Defense Logistics Agency and Defense Information Systems Agency. These 

organizations have the capacity and experience in developing and implementing policies applicable to 

requirements for the entire enterprise.

Conclusions

The panel acknowledges Congress’ ongoing work in this area as a step in the right direction, 

specifically the passage of S. 3085, the Federal Acquisition Supply Chain Security Act of 2018, which 

mandates the creation of a Federal Acquisition Supply Chain Security Council. DoD should develop a 

system for directing risk mitigation requirements across the enterprise outside the DFARS. DoD needs 

a Supply Chain Assurance Council that can bring appropriate technical expertise to bear quickly to 

develop policy solutions. It also needs an execution arm that can deploy policy and oversee its 

implementation. Congress should amend Sec. 807 of the FY 2018 NDAA to incorporate this 

recommendation in its effort to enhance supply chain scrutiny.

Implementation

Legislative Branch

§ Amend Section 807 of the FY 2018 NDAA to require DoD implement tools for supply chain risk 

mitigation policies through the requirements generation process rather than through the DAR 

Council process.

Executive Branch

§ Require the Secretary of Defense develop tools and processes for implementing supply chain 

risk mitigation policies through the requirements generation process rather than through the 

DAR Council process.

Implications for Other Agencies

§ There are no cross-agency implications for this recommendation.