GAO 

United States Government Accountability Office

Report to Congressional Committees

DEFENSE 

CONTRACTING 

INTEGRITY 

Opportunities Exist to 

Improve DOD’s 

Oversight of 

Contractor Ethics 

Programs 

September 2009 

GAO-09-591 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

September 2009

DEFENSE CONTRACTING INTEGRITY

Opportunities Exist to Improve DOD's Oversight of 

Contractor Ethics Programs

Highlights of GAO-09-591, a report to 

congressional committees 

Until recently, ethics programs and 

practices of defense contractors 

were self-policed. Given the 

significant sums spent to acquire 

goods and services, the Federal 

Acquisition Regulation (FAR) was 

amended twice starting in 

December 2007 to first mandate 

and later amplify contractor ethics 

program rules. Before FAR changes 

were finalized in December 2008, 

Congress required GAO to report in 

2009 on the ethics programs of 

major defense contractors. This 

report (1) describes the extent that 

contractors had ethics programs 

before the finalization of the FAR 

rules that included practices 

consistent with standards now 

required by the FAR and 

(2) assesses the impact the new 

FAR rules have on Department of 

Defense (DOD) oversight of 

contractor ethics programs. To do 

this work, in September 2008 GAO 

surveyed all 57 contractors—those 

receiving more than $500 million in 

2006 DOD contract awards—and 

interviewed DOD contractor 

oversight agency officials on the 

impact of the new FAR rules on 

oversight. 

What GAO Recommends

GAO recommends four actions 

aimed at improving oversight of 

ethics programs during contract 

administration and DOD hotline 

poster requirements for 

contractors to ensure that 

whistleblower protections are 

communicated. DOD concurs with 

GAO’s recommendations. 

All 57 contractors responded to GAO’s survey, and 55 reported having ethics 

programs that include many of the practices consistent with standards now 

required for compliance with the FAR. The ethics practices information GAO 

obtained was from before the FAR rules were finalized and thus was not 

designed to test contractor compliance with the rules that came later. 

 

Contractor Responses on Ethics Practices Now Required by the FAR 

FAR standard Contractors reporting these practices

Code of business ethics and 

conduct 

- 55 have written codes 

- 54 provide copies to employees 

Ethics awareness and 

compliance program 

- 55 have ongoing programs 

- 51 require ethics training for employees and managers working 

on DOD contracts 

- 55 use other mechanisms to communicate employee ethics 

awareness and compliance 

Internal control system 

High level of management 

oversight 

- 52 have an office or individual charged with implementing the 

ethics program 

- 25 report quarterly top management oversight of ethics program 

managers 

Periodic reviews, audits, or 

both 

- 52 have internal reviews or audits to test ethics program 

- 47 periodically assess risks of improper or criminal conduct 

Mechanisms for reporting 

misconduct 

- 55 have internal reporting mechanisms, such as hotlines 

- 54 have a policy for employees to report anonymously or 

confidentially 

Disciplinary systems - 52 have codes that provide examples of disciplinary 

consequences, such as counseling and termination 

Timely disclosure - Before FAR rule, 34 had a formal policy for voluntary disclosure 

to DOD of contract-related violations 

- After FAR rule, 4 contractors GAO visited changed disclosure 

policy to comply with new mandatory disclosure requirement 

Source: GAO analysis of contractor survey. 

In response to the new FAR rules, DOD has made two key oversight 

improvements by revising its contract audit guidance to cover the new ethics 

requirements and establishing the Contractor Disclosure Program to 

implement the mandatory disclosure requirement. However, opportunities 

exist to improve DOD’s oversight in two other key areas. For example, in 

verifying implementation of contractor ethics programs during contract 

administration, the impact of the FAR rules on oversight at this point is 

negligible. GAO found that DOD had no plans to change contract 

administration offices’ oversight because authority for oversight is not explicit 

nor is organizational responsibility clear. Also, with regard to contractors’ 

hotline poster displays, the new FAR rules could reduce DOD’s awareness of 

potential violations. The rules exempt contractors with ethics programs that 

include their own hotlines from the requirement to display DOD hotline 

posters. If contractor employees report violations to company hotlines instead 

of DOD hotlines, the employees do not receive the same protections from 

whistleblower laws. Whistleblower protections for employees unaware of the 

DOD hotline could be jeopardized. 

View GAO-09-591 or key components.

For more information, contact John Needham 

at (202) 512-4841 or needhamjk1@gao.gov. 

To view the e-supplement online, click GAO09-646SP
Page i GAO-09-591 

Contents 

Letter 1

Background 4 

Contractors Report Using a Range of Ethics Program Practices 

Now Required by the FAR 8 

New FAR Rules May Improve DOD Oversight of Contractor Ethics 

Programs in Some Areas but Not Others 18 

Conclusions 30 

Recommendations for Executive Action 31 

Agency Comments 31 

Appendix I Scope and Methodology 34 

Appendix II Comments from the Department of Defense 40 

Appendix III Required Federal Acquisition Regulation Components 

for Contractor Ethics Programs 43 

Appendix IV GAO Contact and Staff Acknowledgments 44 

Tables 

Table 1: DOD Organizations Responsible for Oversight and 

Management of DOD Contracting Activities in Which 

Contractor Ethics Programs May Be Examined 5 

Table 2: Contractor Responses on Ethics Practices Now Required 

by the FAR 8 

Table 3: Highlights of GAO Contractor Survey and FAR Public 

Comments regarding Benefits to Contractors and 

Challenges They Face in Implementing FAR Ethics Rules 10 

Table 4: Contractor Responses on Practices Now Required by the 

FAR for Code of Business Ethics and Conduct 12 

Table 5: Contractor Responses on Business Ethics and Awareness 

Practices for Communicating Information concerning 

Individual Roles and Responsibilities 13 

 DOD Contractor Ethics Programs 
Table 6: Contractor Responses on Assignment of Ethics Program 

Responsibility and High-Level Oversight 14 

Table 7: Contractor Responses on Periodic Reviews and Audits 15 

Table 8: Contractor Responses on Anonymous/Confidential 

Reporting of Misconduct and Contract-Related Violations 16 

Table 9: Contractor Responses on Ethics-Related Disciplinary 

Action 17 

Table 10: Comparison of Ethics Program Elements in 

Congressional Mandate and FAR Requirements 34 

Table 11: Contractors Reviewed by GAO, by Value of Total 

Contract Awards from DOD in Fiscal Year 2006 35 

Table 12: Required FAR Components for Contractor Ethics 

Program Practices 43 

Figure 

Figure 1: DOD Hotline Posters Available for Contractor Display 27 

Abbreviations 

ACO administrative contracting officer 

AT&L Acquisition, Technology, & Logistics 

CAM Defense Contract Audit Agency, Contract Audit Manual

CAO contract administration office 

DAR Defense Acquisition Regulation 

DCAA Defense Contract Audit Agency 

DCMA Defense Contract Management Agency 

DFARS Defense Federal Acquisition Regulation Supplement 

DOD Department of Defense 

DOJ Department of Justice 

DOD IG Department of Defense Inspector General 

FAR Federal Acquisition Regulation 

GAO Government Accountability Office 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 

Page ii GAO-09-591 DOD Contractor Ethics Programs
Page 1 GAO-09-591 

 

United States Government Accountability Office

Washington, DC 20548 

 

September 22, 2009 

Congressional Committees 

In fiscal year 2008, the Department of Defense (DOD) spent more than 

$387 billion for goods and services from more than 85,000 contractors. 

Given the magnitude of taxpayer money at stake, it is essential that 

defense contractors conduct their business operations with integrity. In 

the last several years there have been a number of cases of fraud, waste, 

and abuse in wartime contracting and even some high-profile criminal and 

civil convictions of large defense contractors because of procurement 

integrity and foreign corrupt practices violations. These procurement 

fraud cases heightened concerns in Congress and the executive branch 

about the adequacy of defense contractors’ ethics programs in preventing 

or addressing misconduct that could put billions of dollars of contracted 

goods and services at risk. 

In the past, DOD’s policy under the Defense Federal Acquisition 

Regulation Supplement (DFARS) encouraged contractors to have written 

ethics policies and recommended practices, such as ethics training for all 

employees and hotlines or other internal mechanisms for them to report 

suspected misconduct.1

 Essentially, defense contractor ethics programs 

were voluntary and self-policed. Moreover, our prior work raised concerns 

that DOD lacked adequate oversight of its contractors’ ethics programs, 

recommending that enhanced knowledge of contractor ethics programs 

would enable DOD to assess whether the public trust is protected.2

Given the significant sums of federal dollars spent by agencies to acquire 

goods and services, and the need to establish a clear and consistent policy 

regarding contractor code of ethics and business conduct, the Federal 

Acquisition Regulation (FAR) was amended twice to address contractor 

1

 DFARS is a supplement to the Federal Acquisition Regulation (FAR) that provides DODspecific regulations. Among its requirements, DFARS contains DOD-wide policies and 

deviations from FAR requirements. 

2

 GAO, Defense Ethics Program: Opportunities Exist to Strengthen Safeguards for 

Procurement Integrity, GAO-05-341 (Washington, D.C.: Apr. 29, 2005). In concurring with 

this report, DOD stated that the recommendation to assess contractor ethics programs was 

currently implemented when contracting officers, before awarding a contract, make an 

affirmative determination of responsibility, which includes consideration of the potential 

contractor’s business practices and the potential contractor’s integrity. 

 DOD Contractor Ethics Programs 
 

ethics programs. In December 2007 and again in December 2008, the FAR 

was amended first to mandate and then to amplify governmentwide ethics 

program requirements for certain contractors.3

 Contractors’ internal 

programs must now include an ethics and compliance system with several 

practices aimed at preventing and detecting misconduct and at promoting 

an organizational culture that encourages ethical conduct and a 

commitment to compliance with the law. Before FAR changes were 

finalized in late 2008, Congress included a provision in the National 

Defense Authorization Act for Fiscal Year 2008 requiring us to report on 

the internal ethics programs of major defense contractors—defined as any 

company that received more than $500 million in DOD contract awards in 

fiscal year 2006—and the extent to which DOD monitors or approves 

them.4

 In January 2009, we briefed your committees on the preliminary 

results regarding the reporting requirements specified in the act. Taking 

into consideration the new FAR contractor ethics program rules, which 

are very similar to some of the reporting requirements specified in the act,5

this report (1) describes the extent to which contractors had ethics 

programs before the finalization of the FAR rules that included practices 

consistent with standards now required by the FAR and (2) assesses the 

impact the new FAR rules have on DOD oversight of contractor ethics 

programs. 

To select contractors for review, we used DOD’s contract award data and 

identified 57 major defense contractors receiving more than $500 million 

in fiscal year 2006 for review. To obtain information on contractor ethics 

programs and practices, in September 2008 we surveyed all 57 contractors. 

We also obtained corroborating documentation for various practices—

including those consistent with the FAR’s standards, such as management 

oversight and ethics and compliance training—and information about the 

benefits to contractors and the challenges they face in implementing the 

new FAR ethics rules. We analyzed responses from all 57 contractors and 

 

3

 Since December 24, 2007, contractors receiving awards worth more than $5 million and 

involving work in excess of 120 days have been required to have a written code of business 

ethics and conduct. However, until further amended effective December 12, 2008, the rule 

did not apply to contracts for commercial items or to contracts performed outside the 

United States. 72 Fed. Reg. 65873-82 (Nov. 23, 2007). 

4

 The National Defense Authorization Act for Fiscal Year 2008, Pub. L. No. 110-181 § 848. 

5

 App. I provides a side-by-side comparison in table 10 of the ethics program elements 

identified in § 848 for inclusion in this report with those contractor ethics program 

elements now required by the FAR, all of which became the basis for our survey on major 

defense contractors’ ethics programs. Pub. L. No. 110-181 § 848 (2008). 

Page 2 GAO-09-591 DOD Contractor Ethics Programs
 

reviewed the FAR Council’s disposition of public comments considered as 

part of the rulemaking process for additional perspectives on benefits to 

contractors and challenges they face implementing new ethics program 

rules.6

 While we reviewed the contractors’ self-reported practices for 

consistency with the FAR rules that came later, we did not test them for 

effectiveness or compliance. We selected a nongeneralizable sample of 

four contractors for site visits in order to review in detail implementation 

practices for some of the ethics program policies or procedures described 

in their survey responses. We chose these four contractors because 

(1) they ranked among the top 15 contractors in terms of dollar value of 

fiscal year 2006 DOD contract awards and (2) their survey responses 

indicated that they had such policies or procedures in use. 

To assess the impact the new FAR contractor ethics rules have on DOD, 

we focused on defense and military organizations responsible for 

oversight and investigation of contractor operations and improper 

business practices.7

 These organizations included the (1) Defense Contract 

Management Agency (DCMA); (2) Defense Contract Audit Agency 

(DCAA); (3) DOD Office of the Inspector General (DOD IG); (4) Air Force, 

Army, and Navy offices responsible for suspension and debarment; and 

(5) Office of the Under Secretary of Defense for Acquisition, Technology 

and Logistics (AT&L). We interviewed senior procurement officials; 

general counsel; and contract administration, audit, and investigative 

service officials concerning these agencies’ roles and responsibilities for 

monitoring or approving contractor ethics programs. Through interviews 

and information obtained from these officials, we obtained views and 

reviewed supporting documentation concerning the impact the new FAR 

rules have had or could have on DOD contractor oversight activities 

related to monitoring contractors’ compliance with ethics program 

practices required by the new rules. We did not test DOD agencies’ 

 

6

 The FAR Council—whose members include the DOD Director of Defense Procurement 

and Acquisition Policy, the National Aeronautics and Space Administration Associate 

Administrator for Procurement, and the General Services Administration Chief Acquisition 

Officer—oversees development and maintenance of the FAR. The Office of Federal 

Procurement Policy Administrator in the Office of Management and Budget serves as chair 

of the FAR Council, which meets quarterly to discuss and resolve significant or 

controversial FAR changes. 

7

 For purposes of this report, an improper business practice is defined as a known or 

suspected violation of federal criminal law involving fraud, conflict of interest, bribery, or 

gratuity violations found in title 18 of the United States Code or a violation of the civil False 

Claims Act. 

Page 3 GAO-09-591 DOD Contractor Ethics Programs
 

effectiveness in implementing their oversight activities related to 

monitoring contractor ethics programs. 

We conducted this performance audit from May 2008 through August 2009 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives. Appendix I provides additional 

details on our scope and methodology, including a list of the 57 

contractors reviewed. 

Background 

Defense Contractor Ethics 

Programs and DOD 

Oversight before New FAR 

Rules 

Before the FAR changes in December 2007, DFARS provided that 

contractors must conduct themselves with the highest degree of integrity 

and honesty.8

 Specifically, defense regulations provided that contractors 

should have (1) a written code of ethical conduct; (2) ethics training for all 

employees; (3) periodic reviews of compliance with their code of ethical 

conduct; (4) internal audits, external audits, or both; (5) disciplinary 

action for improper conduct; (6) timely reporting to appropriate 

government officials of any suspected violation of law regarding 

government contracts; and (7) full cooperation with any government 

agencies responsible for either investigation or corrective action.9

 While 

defense regulations provided that contractors should have such elements, 

they were not mandatory. As a result, under DFARS and until the FAR 

rules established mandatory ethics program requirements, DOD relied on 

contractor self-governance—through which a company decided if and how 

to implement and enforce ethical conduct. 

Oversight and management of DOD contracting activities is shared among 

various organizations. Collectively, these organizations help detect 

instances of fraud, waste, and abuse; try to prevent them from happening; 

 

8

 48 C.F.R. § 203.7000 (2007). 

9

 48 C.F.R. § 203.7001 (2007). 

Page 4 GAO-09-591 DOD Contractor Ethics Programs
 

or are involved in correcting policies and procedures when they occur.10

For example, the Office of the Under Secretary of Defense for AT&L 

provides policy, guidance, and oversight to acquisition functions. Other 

DOD organizations may examine contractors’ ethics programs under a 

range of authorities for contract administration and audit services. Table 1 

shows DOD organizations involved in overseeing and managing 

contracting activities and their primary responsibilities in examining 

contractors’ ethics programs. 

Table 1: DOD Organizations Responsible for Oversight and Management of DOD Contracting Activities in Which Contractor 

Ethics Programs May Be Examined 

DOD organization Responsibility 

Contract audit services and administration 

DCAA Located on-site at contractor facilities for ongoing contract audit purposes, DCAA audits internal 

control systems—including the contractor’s control environment for integrity and ethical values—every 

3 to 4 years, and reports on adequacy of controls. According to DCAA, the contractor’s control 

environment has a pervasive influence on its business activities and is the foundation for all other 

internal control systems, such as billing and labor. DCAA also makes investigation referrals, usually to 

the DOD IG, regarding situations that reasonably appear to entail fraud that it encounters during its 

contract audits. 

DCMA DCMA is a combat support agency responsible for ensuring the integrity of contractual processes and 

provides a broad range of contract and procurement management services to DOD buying 

organizations. As of December 2008, DCMA reports managing 291,000 prime contracts valued at 

$950 billion. Also located on-site for ongoing contract administration purposes, as needed, DCMA 

monitors ethics program corrections in response to DCAA-identified deficiencies. 

Improper business practices 

DOD IG DOD IG conducts audits and oversees matters relating to detection and prevention of fraud, waste, 

and abuse, and collaborates with numerous other DOD entities, as many activities are involved in 

addressing these issues across DOD. DOD IG does not monitor contractor ethics programs per se, 

but may get insight through oversight of and follow-up on irregularities or misconduct reported through 

DCAA, the Defense Hotline Program, and the DOD Contractor Disclosure Program. 

Air Force, Army, and Navy 

offices of general counsel 

suspension and debarment 

officials 

During any administrative suspension or debarment proceeding or in reaching an administrative 

settlement, the contractor’s ethics program may come under the review and approval of the agency’s 

suspension and debarment official. For example, under separate administrative compliance 

agreements from March 2005 through October 2007, the Air Force and Army suspension and 

debarment officials approved changes in and policed compliance with ethics programs of two 

contractors in our study. 

Sources: DOD and FAR (information); GAO (analysis and presentation). 

 

10 See also GAO, Contract Management: DOD Vulnerabilities to Contracting Fraud, 

Waste, and Abuse, GAO-06-838R (Washington, D.C.: July 7, 2006). 

Page 5 GAO-09-591 DOD Contractor Ethics Programs
 

A number of cases involving fraud in wartime contracting in Iraq, Kuwait, 

and Afghanistan and recent scandals involving high-profile defense 

contractors have prompted significant changes in procurement fraud 

investigations, enforcement initiatives, legislation, and regulation. By 2007, 

in view of the trend, the FAR Council commented that the DFARS 

provision that contractors should have specific elements of an ethics 

program was no longer considered strong enough to increase contractor 

compliance with ethical rules of conduct.11

Concerns over 

Procurement Fraud Trends 

Prompt FAR Contractor 

Ethics Rules 

To address this problem, the FAR Council changed the regulations. After 

conducting an extensive proposed rulemaking and public comment 

process from February 2007 through November 2008, the FAR Council 

twice amended the FAR to impose new ethics requirements on 

government contractors. The initial rule—effective in December 2007—

created a new FAR subpart that requires government contractors to have 

written codes of business ethics and ethics compliance training programs 

for contractor employees and to post “fraud hotline” posters at contractor 

work sites to encourage contractor employees to report fraudulent activity 

in connection with performance and award of government contracts.12

However, in December 2008 certain shortcomings in the initial contractor 

ethics rules were addressed in further amendments to the FAR.13 For 

example, public concerns over the first rule’s exemption connected to 

overseas contracting prompted elimination of this exemption in the 

second rule, and as of December 2008, overseas and commercial 

contractors are now required to maintain written codes of business ethics 

and conduct. In addition, the amended FAR contractor ethics rules now 

require contractors to disclose violations of criminal law involving fraud, 

conflict of interest, bribery, or gratuity violations or violations of the civil 

False Claims Act (31 U.S.C. 3729-3733) in connection with award or 

performance of government contracts and subcontracts. It should be 

noted that these requirements are implemented by contract clause and are 

 

11 72 Fed. Reg. 65876 (Nov. 23, 2007). 

12 72 Fed. Reg. 65873-82 (Nov. 23, 2007). 

13 On June 30, 2008, Congress enacted the Close the Contractor Fraud Loophole Act as part 

of the Supplemental Appropriations Act, 2008. The act requires the FAR to include 

provisions that require timely notification by federal contractors of violations of federal 

criminal law or overpayments in connection with the award or performance of covered 

contracts or subcontracts, including those performed outside the United States and those 

for commercial items. Supplemental Appropriations Act, 2008, Pub. L. No. 110-252, Title VI, 

ch. 1. 

Page 6 GAO-09-591 DOD Contractor Ethics Programs
 

mandatory.14 The amended rules also specifically subject contractors to 

suspension and debarment from government contracting for knowingly 

failing to disclose such violations and failing to disclose receipt of 

overpayments on government contracts in a timely manner. 

The FAR changes effective in December 2008 also enhance provisions for 

sound ethics business practices by specifically requiring the establishment 

of internal control systems for 

• facilitating discovery of improper conduct, 

• ensuring that corrective measures are promptly carried out, and 

• otherwise promoting an organizational culture that encourages ethical 

conduct and a commitment to compliance with the law. 

In publishing the December 2008 rule’s amplified requirements, the FAR 

Council stated that the U.S. Sentencing Commission’s federal sentencing 

guidelines are the source of the FAR text, which provides guidance for 

contractors consistent with the guidelines on effective compliance and 

ethics programs for organizations. Among other things, the sentencing 

guidelines state that an ethics and compliance program should be 

reasonably designed, implemented, and enforced so that it is generally 

effective in preventing and detecting criminal conduct. Notably, the 

sentencing guidelines also state that the failure to prevent or detect a 

particular offense does not necessarily mean that the program is generally 

ineffective in preventing and detecting criminal conduct. 

According to the FAR Council, the final rule reflects standards across four 

broad components and establishes a framework for institutional ethics 

management and disclosure, but does not prescribe specific ethical 

requirements. Contractors are free to establish the appropriate ethical 

standards for their businesses. For a more detailed description of the final 

rule’s establishment of standards across four broad components, see 

appendix II. 

 

14 FAR § 3.1004. 

Page 7 GAO-09-591 DOD Contractor Ethics Programs
 

In September 2008 and before the FAR rules were finalized, to identify 

contractor ethics program practices, we surveyed all 57 contractors to 

obtain information on the extent to which their programs included 

practices required or proposed in the FAR or otherwise addressed in 

congressional requirements for this report. As summarized in table 2, 

nearly all of the 57 contractors responding to our survey report using 

many of the ethics practices consistent with standards now required by 

the FAR. The ethics program practices information we obtained was not 

designed to test contractor compliance with the rules that came later. 

Contractors Report 

Using a Range of 

Ethics Program 

Practices Now 

Required by the FAR 

Table 2: Contractor Responses on Ethics Practices Now Required by the FAR 

FAR standard Contractors reporting these practices 

Code of business 

ethics and conduct 

• 55 have written codes 

• 54 provide copies to employees 

Ethics awareness 

and compliance 

program 

• 55 have ongoing programs 

• 51 require ethics training for employees working on DOD 

contracts 

• 55 use other mechanisms to communicate employee ethics 

awareness and compliance 

Internal control system 

High level of 

management 

oversight 

• 52 have an office or individual charged with implementing 

the ethics program 

• 25 report quarterly top management oversight of ethics 

program managers 

Periodic reviews, 

audits, or both 

• 52 have internal audit functions that review ethics program 

effectiveness 

• 47 periodically assess risks of improper or criminal conduct 

Internal mechanism 

for reporting 

misconduct 

• 55 have internal reporting mechanisms, such as hotlines 

• 54 have a policy for employees to report misconduct 

anonymously or confidentially 

Disciplinary 

systems 

• 52 have codes that provide examples of disciplinary 

consequences, for example, warning, counseling, and 

employment termination 

Timely disclosure • Before FAR rule, 34 had a policy for voluntary disclosure to 

DOD of contract-related violations and misconduct 

• Post FAR rule, 4 contractors we visited for follow-up 

changed disclosure policy and procedure to comply with 

new mandatory disclosure requirement 

Source: GAO analysis of contractor survey. 

Page 8 GAO-09-591 DOD Contractor Ethics Programs
 

Notes: At the time of our survey, contracts for the acquisition of commercial items and those that 

would be performed entirely outside the United States were exempt from the requirements shown in 

the table, and none of the contractors were required to timely disclose credible evidence of certain 

violations of federal criminal law or of the civil False Claims Act. In addition, all small businesses are 

exempt from the FAR requirements for an ethics awareness and compliance program and an internal 

control system. In this table and throughout this report, we present data on the number of affirmative 

responses and not data on the number of “no” and “don’t know” responses or the number of 

contractor nonresponses to a question. 

Views of contractors surveyed were mixed with regard to the benefits and 

challenges they face in implementing the FAR contractor ethics rules. 

Contractors responding to our survey cited several expected benefits and 

challenges of the new ethics rules. Other benefits and challenges were 

attributed by the FAR Council to public comments from contractor 

industry and other sources when finalizing the new FAR contractor ethics 

rules in 2008. Some of these benefits and challenges are highlighted in 

table 3. 

Page 9 GAO-09-591 DOD Contractor Ethics Programs
 

Table 3: Highlights of GAO Contractor Survey and FAR Public Comments regarding Benefits to Contractors and Challenges 

They Face in Implementing FAR Ethics Rules 

Contractor benefits from implementing FAR ethics rules 

• Codify good business practices for all contractors and reinforce importance that all businesses conduct themselves in an ethical 

manner. 

• Contribute to a company culture emphasizing business integrity. 

• Provide standard and create a level playing field. 

• Build employee trust and confidence. 

• Reduce contractor liability and risk. 

• Assist contractors subject to similar responsibilities or federal sentencing guidelines if accused of crimes. 

• Benefit the government procurement process as a whole. 

• Reinforce companies’ compliance standards and inhibit unethical conduct. 

• Provide basis for government partners to evaluate contractor’s responsibility and are meaningful for enforcement when something

goes wrong. 

Contractor challenges in implementing FAR ethics rules 

Mandatory disclosure 

• In contrast to existing government programs and contractor initiatives offering ample incentives to voluntarily report contract

violations, mandatory disclosure may eliminate the ability of a contractor to claim the benefit of “timely and voluntary disclosure” to 

the government if the contractor is charged with a crime. 

• Failure to disclose an overpayment on a government contract may create operational difficulties because (1) contracts are subject 

to reconciliation processes with payments audited and adjusted over time and (2) the routine nature of contract payment issues,

which are daily events, with errors on both sides, is simply unworkable. 

• Challenge to interpret vague language, such as “suspected,” “cooperation,” “timely,” and “reasonable grounds to believe,” may tie 

up government resources in meaningless legal trivia. 

• If contractor employees know that everything they report will be passed on to the government, this may result in less reporting up 

the chain of the company rather than more and could decrease rather than enhance cooperation with company ethics compliance 

efforts. 

Other challenges 

• Expanding our awareness program to keep pace with our company growth. 

• Ensuring sufficient training for significant number of employees. 

• Executing the requirement for checking the existence of subcontractor ethics awareness and internal control systems. 

• Utilizing a covered subcontractor outside the United States, as we would expect that many foreign companies may not have 

programs that are as stringent as is required by the FAR, and it could be difficult in some countries to fund a subcontractor with 

such a program. 

Sources: GAO analysis of contractor survey and 73 Fed. Reg. 67064-93. 

With regard to the new FAR rule’s mandatory timely disclosure of certain 

contract-related violations of criminal law or the False Claims Act, several 

contractors responding to our survey as well as industry concerns cited in 

public comments indicated that contractors would face significant 

difficulty in implementing those requirements. In response to these 

concerns, the FAR Council revised key aspects of the final rule regarding 

timely disclosure, including to 

Page 10 GAO-09-591 DOD Contractor Ethics Programs
 

• more closely focus the situations that must be disclosed by limiting 

violations of criminal law to certain violations involving fraud, conflict of 

interest, bribery, or gratuity violations that have occurred in connection 

with the award, performance, or closeout of a contract or subcontract; 

• make “credible evidence” the standard for when timely disclosure should 

occur; 

• add clarification that if a violation relates to more than one government 

contract, the contractor may make the disclosure to the agency officials 

responsible for the largest dollar value contract affected by the violation; 

and 

• limit the application of suspension or debarment to undisclosed 

overpayment cases in which the amount is significant.15

Contractors’ Ethics 

Program Practices 

Highlighted below is some of the aggregated analysis resulting from the 

survey about contractors’ ethics practices. A more complete tabulation of 

survey questions together with tables indicating the levels of response can 

be found in the e-supplement to this report, found on our Web site at 

http://redesign-www.gao.gov/special.pubs/gao-09-646sp/index.html. 

One purpose of a code of conduct can be to communicate a company’s 

statement of ethical values and integrity as established by top leadership. 

Although the FAR does not specify what topics a contractor must include 

in its code of conduct, they can cover a broad range of business ethics and 

conduct standards, such as conflict of interest, relationships with vendors, 

and compliance with government contracting requirements for 

procurement integrity, classified information, and recruiting and 

employing current or former government personnel, according to sources 

Nearly All Contractors Report 

Having a Code of Business 

Ethics and Conduct 

 

15 In finalizing the rule, the FAR Council declined to expressly define “significant 

overpayment” in response to concerns raised in the public comments. Instead, FAR 

Council comments indicated that “significant overpayment” implies more than just dollar 

value and depends on the circumstances of the overpayment as well as the amount. More 

specifically, it is the type of overpayment that the contractor knows will result in unjust 

enrichment and yet fails to disclose. As part of the comments, it was also noted that since 

contractors are required by the FAR’s payment clauses to report and return overpayments 

of any amount, it is within the discretion of the suspension and debarment official to 

determine whether an overpayment is significant. 

Page 11 GAO-09-591 DOD Contractor Ethics Programs
 

on government contractor ethics practices.16 As shown in table 4, nearly all 

of the contractors reported using such practices. 

Table 4: Contractor Responses on Practices Now Required by the FAR for Code of 

Business Ethics and Conduct 

FAR standard Contractors reporting this practice 

Written code of business 

ethics and conduct 

• 55 report having written codes 

• 49 report that their codes include standards of business 

ethics and conduct expected of employees in their work 

on DOD contracts 

Copy of the code 

available to employees 

engaged in contract 

performance 

• 54 provide written or electronic copies of code to 

employees 

• 51 require employee acknowledgment that they 

understand code 

• 52 require employees to agree to uphold the ethics 

standards 

Source: GAO analysis of contractor survey. 

Note: At the time of our survey, contracts for the acquisition of commercial items and those that would 

be performed entirely outside the United States were exempt from the requirements for the code of 

business ethics and conduct. 

One purpose of ongoing contractor ethics awareness and compliance 

programs can be to promote conformance with the code of business ethics 

and requirements. Such programs should include reasonable steps to 

communicate periodically to employees about the contractor’s ethics 

standards and procedures via training programs and communicating 

information on individuals’ roles and responsibilities under the ethics 

program. As shown in table 5, nearly all of the contractors reported 

including steps such as requiring ethics training and periodically 

communicating ethics-related information to employees working on DOD 

contracts. 

Nearly All Contractors Report 

Having an Ethics Awareness 

Program, Compliance Program, 

or Both 

 

16 See The Defense Industry Initiative on Business Ethics and Conduct, 2007 Annual 

Public Accountability Report (Washington, D.C., 2008); Tara A. Edwards and Frank 

Spasoff, “Compliance with the New FAR Ethics and Internal Control Requirements,” 

Contract Management (April 2009): 34-42; and Terrence M. O’Connor, Federal 

Procurement Ethics: The Complete Legal Guide (Vienna, Va.: Management Concepts, 

2009). 

Page 12 GAO-09-591 DOD Contractor Ethics Programs
 

Table 5: Contractor Responses on Business Ethics and Awareness Practices for 

Communicating Information concerning Individual Roles and Responsibilities 

FAR standard 

Number of contractors 

reporting this practice

Have ongoing ethics awareness programs, ethics 

compliance programs, or both 

55

Training required for contractors’ principals and employees and, as appropriate, 

the contractors’ subcontractors 

• Principals (officers, directors, executives, etc.) 48

• Midlevel managers 51

• Permanently hired employees 50

• Short-term employees 37

• Independent contractors/consultants 12

• Employees working overseas 41

• Foreign employees 38

• Subcontractor employees 4

Periodic communication mechanisms to disseminate information appropriate to 

individuals working on contracts on their ethics roles and responsibilities 

• Orientation 54

• Staff meetings 43

• Brochures 36

• One or more other communication mechanisms 

(newsletter, e-mail, posters, etc.) 

55

Source: GAO analysis of contractor survey. 

Notes: The standards reflected in the FAR establish a framework for institutional ethics management 

and are displayed above in bold. As shown in the bulleted text above, because the FAR does not 

prescribe specific ethical requirements, our survey included multiple-choice questions about the types 

of (1) employees to whom contractors provided ethics training and (2) periodic communication 

mechanisms used. 

All 41 contractors that reported having overseas contract operations 

indicated that they had incorporated their ethics awareness and 

compliance programs overseas. However 26 contractors reported 

experiencing challenges implementing ethics programs overseas, including 

differences in legal and regulatory environments relating to, for example, 

employee privacy, cultural and language barriers, and technical or hostile 

conditions impeding computer-based training. 

Page 13 GAO-09-591 DOD Contractor Ethics Programs
 

Having contractors implement internal control systems increases the 

likelihood that their ethics and compliance programs are generally 

effective in preventing, detecting, and addressing contract-related fraud, 

waste, and abuse. Nearly all of the contractors in our survey reported 

using internal control practices consistent with the FAR’s standards. 

Internal Control Systems 

• High-level of management oversight. By assigning responsibility at a 

sufficiently high level and providing adequate staffing to ensure the 

effectiveness of the ethics program, a contractor can demonstrate true 

interest and involvement of management.17 As shown in table 6, most 

contractors report formally assigning responsibility and staff resources to 

an office or individual and several have their ethics managers report on a 

regular basis to top management. Site visits with four contractors showed 

that all had ongoing and active high-level management oversight of their 

ethics programs. 

Table 6: Contractor Responses on Assignment of Ethics Program Responsibility 

and High-Level Oversight 

Practice 

Number of contractors 

reporting this practice 

Formally assign responsibility to an office or individual to 

implement ethics and compliance program 

52

Regular reporting about business ethics awareness and 

compliance to these management levels 

• Chief executive officer 25 (quarterly); 7 (monthly)

• President 17 (quarterly); 4 (monthly)

• Board of directors 15 (quarterly); 0 (monthly)

• Board ethics committee, compliance committee, or 

both 

10 (quarterly); 0 (monthly)

Source: GAO analysis of contractor survey. 

Notes: The standards reflected in the FAR establish a framework for institutional ethics management. 

Because the FAR does not prescribe specific ethical requirements for assignment of responsibility at 

high levels for program responsibility or management oversight, our survey included open-ended and 

multiple-choice questions about the types of (1) individuals or offices responsible for the ethics and 

compliance program and (2) periodic reporting to various management levels. At the time of our 

survey, contracts for the acquisition of commercial items and those that would be performed entirely 

outside the United States were exempt from the internal control system requirements for 

management oversight. Although the FAR exempts small businesses from the internal control system 

requirements, nearly all contractors told us that they are not small businesses. However, if a 

contractor did not report assigning responsibility to implement an ethics and compliance program, we 

did not verify whether the company might fall under the commercial item or overseas exemptions. 

 

17 Edwards and Spasoff, 40. 

Page 14 GAO-09-591 DOD Contractor Ethics Programs
 

• Periodic reviews and audits. An internal control system should be 

reviewed regularly from a compliance perspective through periodic risk 

assessments and audits.18 Most of the contractors reported a range of 

practices for periodic reviews and audits, as shown in table 7. In the case 

of our four site visits, we confirmed that all four contractors had internal 

audits or reviews of their ethics program as recently as 2008. Examples of 

risk areas addressed by these contractors’ internal ethics program audits 

include procurement integrity, foreign corrupt practices, and compliance 

with the code of conduct and policy for employee background checks. 

Table 7: Contractor Responses on Periodic Reviews and Audits 

Practice 

Number of contractors 

reporting this practice

Internal audit or review function that audits business ethics 

program 

52

Mechanisms to monitor effectiveness of ethics program 

• Periodic evaluation of business practices, procedures, 

policies, and internal controls 

52

• Periodic assessments of the risk of improper or criminal 

conduct 

47

• Program modifications in response to risk assessment to 

reduce risk of improper or criminal conduct 

46

• Monitoring and auditing to detect improper or criminal 

conduct 

49

Source: GAO analysis of contractor survey. 

• Internal mechanism for reporting misconduct. Having and publicizing a 

system such as a hotline through which employees can anonymously and 

confidentially report or seek guidance facilitates detecting and addressing 

unethical and illegal activity related to contracts and helps promote a 

culture that encourages ethical conduct and a commitment to compliance 

with the law.19 As shown in table 8, most of the contractors reported 

having such mechanisms and policies for employees to anonymously or 

confidentially report suspected misconduct and contract-related 

violations. 

 

18 Edwards and Spasoff, 41, and O’Connor, 7-10. 

19 United States Sentencing Commission, Guidelines Manual, § 8B2.1 (November 2007). 

Page 15 GAO-09-591 DOD Contractor Ethics Programs
 

Table 8: Contractor Responses on Anonymous/Confidential Reporting of 

Misconduct and Contract-Related Violations 

Practice 

Number of contractors 

reporting this practice

Policy for employees to anonymously and/or confidentially 

report known or suspected conduct that violates ethics 

standards or contract-related requirements 

54

One or more mechanisms for reporting such known or 

suspected conduct 

55

• Hotline/helpline 54

• Ethics officers 45

• Ethics/compliance office telephone number 49

• E-mail 53

Source: GAO analysis of contractor survey. 

In addition, of the 57 contractors responding to our survey, 45 reported 

using one or more mechanisms (for example, posters or training) to let 

employees know about external mechanisms for reporting contractrelated misconduct, such as DOD IG’s hotline, and 55 reported notifying 

employees of their federal whistleblower protections through one or more 

mechanisms, such as their ethics codes or training.20

• Disciplinary systems. A disciplinary system is part of providing 

appropriate incentives to perform in accordance with the ethics and 

compliance program and further demonstrates appropriate follow-through 

in investigating, disciplining, and correcting ethics violations.21 As shown 

in table 9, 53 of the 57 contractors report including a disciplinary system in 

their ethics programs, with consequences ranging from warning to 

termination practices. To ensure that prompt corrective measures are 

carried out when violations are substantiated, 35 of the contractors 

 

20 Since January 2009, 10 U.S.C. § 2409 and 41 U.S.C. § 251 et seq. address protections for 

contractor employees who disclose information to government officials with regard to 

waste or mismanagement, danger to public health or safety, or violation of law related to a 

DOD contract or grant. Specifically, an employee may not be discharged, demoted, or 

otherwise discriminated against as a reprisal for disclosing to the government information 

concerning contract-related violations. As of January 2009, DOD regulations also require 

contractors to inform their employees in writing of these federal whistleblower rights and 

protections. DFARS Subpart 203.970. 

21 James C. Fontana, J. Scott Hommer III, and Peter A Riesen, “The Brave New World of 

Government Contractor Compliance Programs: Maximizing Effectiveness and Minimizing 

Risk,” Contract Management (January 2009): 48-59. 

Page 16 GAO-09-591 DOD Contractor Ethics Programs
 

reported such practices as having specific offices or individuals, while 12 

reported having committees, responsible for coordinating and tracking 

that appropriate discipline is administered. Site visits with 4 contractors 

confirmed that all 4 kept extensive records for management to track and 

oversee disciplinary actions by category of conduct violation, employee 

category, and business unit. 

Table 9: Contractor Responses on Ethics-Related Disciplinary Action 

Practice 

Number of contractors 

reporting this practice

Code of ethics states that there will be disciplinary 

consequences for conduct that violates organization’s 

business ethics and standards 

53

Code of ethics provides examples of potential disciplinary 

consequences, such as warning, counseling, and 

employment termination 

52

Source: GAO analysis of contractor survey. 

Since the FAR rule mandating timely disclosure of contractors’ credible 

evidence of violations was not yet in effect at the time of our survey, we 

asked contractors about policies for voluntarily disclosing to DOD 

conduct in connection with defense contracts that may violate applicable 

requirements of law or regulation. Of the 57 contractors responding to the 

survey, 39 indicated that they had self-reporting policies. Of these, 34 said 

that their policy was to voluntarily disclose or self-report violations to 

government officials, such as DOD IG, contracting officers, DCMA, and 

DCAA. Fifteen of these contractors provided copies of their self-reporting 

policies. Of the 18 that indicated that they did not have self-reporting 

policies, 10 said it was their practice to self-report or voluntarily disclose, 

or to encourage the practice of self-reporting, violations to government 

officials. In addition, some of the contractors that had self-reporting 

policies reported that the types of contract-related violations subject to 

their self-disclosure policies and practices included 

Timely Disclosure 

• violations of law and instances of significant employee misconduct, 

• instances where there may have been overbilling caused by employee 

mischarging and other instances of misconduct, 

• violation of the Anti-Kickback Act of 1986, 

• compromise of product integrity, 

• violations of federal procurement law, 

• violations that added costs to the government, 

• cost accounting violations, and 

• suspected fraud. 

Page 17 GAO-09-591 DOD Contractor Ethics Programs
 

Notably, in site visits with four contractors following the November 2008 

publication of the FAR’s mandatory rule for timely disclosure of certain 

contract-connected violations, senior ethics program managers provided 

us information showing that all organizations were changing their 

voluntary disclosure policies to implement this new FAR requirement. 

In response to the new FAR rules, DOD has made changes in two key 

areas that could improve oversight of contractor ethics programs. 

Specifically, DCAA revised its contract audit guidance to cover the new 

FAR ethics requirements. In addition, DOD IG established the new 

Contractor Disclosure Program to implement the new mandatory 

disclosure requirement. However, additional opportunities exist to 

improve DOD’s oversight in two other key areas. For example, in a third 

area DOD has not assigned responsibility for verifying implementation of 

contractor ethics programs during contract administration. The impact of 

the FAR rules on oversight at this point is negligible because the authority 

for oversight is not explicit nor is organizational responsibility clear. In a 

fourth area—hotline poster displays—the new FAR rules could have the 

adverse consequence of reducing DOD’s awareness of potential ethics 

violations. Under the rules, contractors have been exempted from the 

requirement to display DOD hotline posters if they have their own internal 

hotlines. This is important because if contractor employees make reports 

of contract-related fraud, waste, and abuse to the company hotlines 

instead of DOD hotlines, DOD will be less aware of potential problems. In 

addition, if employees use contractor hotlines instead of DOD hotlines, the 

employees do not receive the same protections from whistleblower laws. 

New FAR Rules May 

Improve DOD 

Oversight of 

Contractor Ethics 

Programs in Some 

Areas but Not Others 

DCAA Developed New 

Audit Guidance on Internal 

Controls for Contractor 

Integrity and Ethical 

Values 

Although DCAA provides a range of services to contracting officers and 

other DOD officials, DCAA’s primary function is contract audit services.22

As part of its ongoing oversight of contractor performance during the 

contract administration phase, DCAA’s field audit offices conduct periodic 

audits of contractor internal control systems. In carrying out such contract 

 

22 To facilitate DCAA’s contract audit work, under its decentralized organizational 

structure, DCAA has field audit offices that include resident offices at larger contractor 

facilities such as those included in this study. 

Page 18 GAO-09-591 DOD Contractor Ethics Programs
 

audits, DCAA personnel are to follow the standards, policies, and 

techniques prescribed in the DCAA Contract Audit Manual (CAM).23

Senior headquarters policy and planning managers responsible for DCAA’s 

auditing standards indicated that the impact of the FAR contractor ethics 

rules on DCAA contract audits has been to improve audit guidance. To 

incorporate the December 2008 FAR ethics rules into its audits of 

contractor controls for integrity and ethical values, in July 2009 the agency 

distributed to its field audit offices revisions of a section of the CAM and 

its associated audit program.24 Earlier in June 2009, when the Chief, 

Auditing Standards Division updated us on the status of extensive 

revisions then under way to improve the CAM audit guidance, she 

indicated that the revised guidance under development would integrate 

the new FAR standards into DCAA’s auditing program. This was a change 

by DCAA since February 2009 when headquarters officials told us that 

they planned to make only minor changes. In their view, this was because 

many of the new FAR requirements were already in the DFARS section 

upon which the earlier audit program was based. 

When we subsequently discussed preliminary findings to that effect in 

June 2009, the Chief, Auditing Standards Division told us that the agency 

had reconsidered its approach and was then proceeding to develop much 

more extensive audit guidance revisions than what had earlier been 

anticipated. In July 2009, DCAA provided us with its revised audit 

guidance, including the section of the CAM on controls for contractor 

integrity and ethical values and the associated audit program. DCAA’s new 

guidance now integrates the FAR standards into DCAA’s auditing program 

for identifying potential internal control deficiencies in contractors’ ethics 

and compliance programs. 

DOD IG Established 

Contractor Disclosure 

Program as Required by 

New FAR Rule 

The new FAR rule’s requirement that contractors timely disclose credible 

evidence of certain violations of federal criminal law or violations of the 

civil False Claims Act made it necessary in December 2008 for DOD IG to 

replace its Voluntary Disclosure Program with the new Contractor 

 

23 Defense Contract Audit Agency, DCAA Contract Audit Manual, DCAAM 7640.1 (Nov. 5, 

2008). 

24 CAM 5-306—Integrity and Ethical Values, in 5-300 Section 3—Audit of Internal 

Controls—Control Environment and Overall Accounting System Controls. 

Page 19 GAO-09-591 DOD Contractor Ethics Programs
 

Disclosure Program. According to the program’s manager, DOD’s new 

contractor disclosure process provides 

• contractors with Web-based and alternative means to report violations in 

writing; 

• coordinated evaluation of criminal, civil, and administrative actions with 

Department of Justice (DOJ) and DOD stakeholders (including offices for 

the Army, Navy, and Air Force suspension and debarment authorities and 

buying agencies or weapon systems affected by the disclosure); 

• a framework for the government to verify and, when appropriate, act on 

certain violations discovered through contractor self-policing; and 

• centralized management combined with decentralized execution and 

faster turnaround of the investigative and prosecution processes. 

To implement the new FAR rules, DOD took immediate steps—none of 

which existed under the Voluntary Disclosure Program—to direct 

reporting of all contractor disclosures to the Contractor Disclosure 

Program.25 DOD IG also made early instructions available to contractors 

on submitting information via the Contractor Disclosure Program Web site 

and, in February 2009, issued a contractor’s guide to submitting a 

disclosure.26 The guide states that disclosures are made with no advance 

agreement regarding possible DOD resolution of the matter and with no 

promises from DOJ regarding potential civil or criminal actions. In the 

event of disclosures of potential criminal liability, however, prompt 

disclosure, full cooperation, complete access to necessary records, 

restitution, and adequate corrective actions are key indicators to DOD of 

an attitude of contractor integrity. DOD IG is also developing 

instructions—to be issued in 2009—to provide internal guidance on 

various DOD contractor oversight agencies’ roles and responsibilities 

under the Contractor Disclosure Program. The instructions call on the 

agencies to extensively coordinate and share management of the 

investigation/prosecution processes. 

 

25 For example, in December 2008 the Under Secretary of Defense for AT&L issued a 

memorandum to provide DOD contracting officers with guidance regarding implementing 

the FAR requirement for contractors’ timely disclosure, in writing, to the DOD IG office of 

certain contract-connected violations. The Under Secretary’s memorandum expressly 

notified DOD contracting officers of the DOD IG’s designation and address for its new 

Contractor Disclosure Program. AT&L also initiated actions that month to incorporate this 

guidance in DFARS. Under Secretary of Defense (AT&L) Memorandum, DOD 

Implementation of the Disclosure Requirement Under FAR Clause 52.203-13 (Dec. 29, 

2008). 

26 The DOD IG site at http://www.dodig.mil has Web-based disclosures and related guidance 

for the Contractor Disclosure Program. 

Page 20 GAO-09-591 DOD Contractor Ethics Programs
 

Before the new program, the DOD Voluntary Disclosure Program—

administered by DOD IG since 1986—had been largely ignored by 

contractors for the past 10 years, according to comments received by the 

FAR Council from DOJ and inspectors general. The number of contractor 

disclosures to the Voluntary Disclosure Program fell steeply over its 22-

year history, declining from about 40 to 60 voluntary disclosures accepted 

per year in its early years to only 9 voluntary disclosures accepted in 

2008.27 According to the program’s manager, in the first 7 months since the 

mandatory program’s start-up in December 2008, DOD has received 41 

disclosures from contractors.28

DOD IG headquarters officials told us that the agency will include 

information on the Contractor Disclosure Program—such as the volume, 

nature, and disposition of active and closed disclosure cases—as part of 

its semiannual report to Congress.29

New FAR Rules Do Not 

Call for Verifying 

Implementation of 

Contractor Ethics 

Programs during Contract 

Administration 

The FAR does not specifically require contracting officials to conduct 

oversight of contractors’ ethics programs during contract administration, 

for example, verifying that the contractor has implemented the new 

mandatory contractor business ethics requirement. In contrast, in certain 

other areas of the acquisition process the FAR provides guidance for 

contracting personnel regarding contractor oversight that could serve as a 

model for DOD to use in considering whether to step up oversight of 

 

27 This disclosure history does not include an unknown number of matters voluntarily 

disclosed by contractors that DOD IG did not accept into the Voluntary Disclosure 

Program. For example, a disclosure would not be accepted into the program if the 

government had prior knowledge of the matter(s) disclosed, such as through government 

audit, investigation, contract administration efforts, or reports to the government by third 

parties. According to the Program Manager, Contractor Disclosure Program, total annual 

voluntary disclosures accepted by DOD IG into the program ranged as high as 59 cases in 

1988 to as low as 3 cases in 2007. 

28 The volume of disclosures into the Contractor Disclosure Program is not strictly 

comparable to the volume of voluntary disclosures, according to the program’s manager. 

Unlike its practices under the Voluntary Disclosure Program, DOD IG accepts into the 

Contractor Disclosure Program all disclosures submitted from contractors. This would 

include accepting even disclosures of matter(s) that the government has prior knowledge 

of through audit, investigation, contract administration efforts, or reports by third parties. 

29 As required by the Inspector General Act of 1978, as amended, DOD IG reports 

semiannually to Congress. According to DOD IG, the semiannual report not only provides 

Congress and the taxpayer with a detailed account of what this organization has done 

during each half of each fiscal year, it is the embodiment of two important concepts upon 

which the agency is based—accountability and transparency. 

Page 21 GAO-09-591 DOD Contractor Ethics Programs
 

contractor ethics programs during contract administration. This guidance 

identifies several areas for which express responsibility is assigned to 

contracting officials for verifying contractor compliance with applicable 

laws and regulations. These areas include activities related to 

environmental practices and a drug-free workplace. In addition, guidance 

is provided to contracting personnel regarding, as applicable, quality 

assurance and safety, both of which are cited in the FAR as general 

standards for determining whether a prospective contractor is responsible, 

just as having a satisfactory record of integrity and business ethics is a 

responsibility standard.30 Such oversight during contract formation and 

administration is done, in part, to avoid any adverse impacts on contract 

performance or cost after contract award. 

As DOD’s lead contract administration agency, DCMA provides a range of 

services to contracting officers and other DOD officials after contract 

award.31 If assigned to do so by a contracting officer as part of DCMA’s 

contract administration responsibilities after contract award, DCMA 

monitors contractor performance and management systems to ensure that 

cost, quality, and schedule are in compliance with the terms and 

conditions of the contracts.32 DCMA’s monitoring is primarily performed 

by an administrative contracting officer (ACO) located in the field at a 

contract administration office (CAO) who is assigned to administer the 

 

30 FAR subpart 9.1. 

31 As of December 2008, DCMA reports managing 291,000 prime contracts valued at 

$950 billion. However, according to DCMA headquarters officials, most contracts DCMA 

manages pertain to major weapon system procurements. Not generally covered by DCMA’s 

contract management services are most of DOD’s services contractors, other than those on 

a limited number of services contracts related to DOD weapon systems maintenance and 

the Army’s Logistics Civil Augmentation Program contract to support worldwide 

contingency operations. 

32 After contract award, the procuring contracting officer at the buying office may or may 

not assign contract administration (i.e., oversight) responsibility to a separate office. If the 

contracting officer does not assign this responsibility to a separate office, contract 

administration remains the contracting officer’s responsibility. Under the FAR, when a 

contract is assigned for administration, the contracting officer normally delegates portions 

of a list of 70 specific contract administration functions to a designated contract 

administration office (CAO). FAR Subpart 42.3—Contract Administration Office Functions. 

Under DFARS, some additional CAO functions are identified for the review and evaluation 

of certain other contractor cost estimating and accounting systems. DFARS Subpart 

242.3—Contract Administration Office Functions. 

Page 22 GAO-09-591 DOD Contractor Ethics Programs
 

contract with assistance from engineers and other specialists at DCMA.33

To specifically combat procurement fraud with a strong focus on assisting 

CAOs through coordination of remedies and process improvement, DCMA 

also has a Contract Integrity Center—operated by its Office of General 

Counsel—with attorneys geographically dispersed across the United 

States. According to DCMA, these contracting integrity attorneys work 

full-time on the prevention, detection, investigation, and prosecution of 

allegations of procurement fraud and other misconduct. 

Despite DCMA having the important role of performing contract 

administration services for many of DOD’s contracts after award, the 

impact of the new FAR rules on changing the CAO function to include 

some degree of oversight to verify implementation of contractor ethics 

programs has been negligible. For example, most of the nine CAO staff we 

talked to who provide ongoing contract administration and oversight of 

seven major DOD contractors told us that they may receive information 

from the contractors or from DCAA on the status of contractors’ ethics 

programs. In addition, they monitor contractor ethics program actions to 

correct internal control deficiencies for integrity and ethical values in 

response to deficiencies discovered during DCAA audits. However, other 

than reacting as information comes to them from the contractor and 

DCAA, the CAO staff indicated that they were not planning to routinely 

verify contractor ethics program efforts. Some of these staff indicated that 

they were willing to monitor contractors’ ethics programs but noted that it 

is currently not required by the FAR. Some staff indicated that if such a 

task was required, criteria or instructions on what to look for would be 

needed. However, the new FAR rules are silent with regard to contracting 

officer review or standards for examining contractor ethics programs 

during contract administration. As such, without further guidance, CAO 

staff will continue as before the new FAR rules were implemented with 

limited oversight of contractors’ ethics programs. 

 

33 On a given contract, there may be two types of contracting officers: (1) the procuring 

contracting officer at the buying office, who awards and signs the contract, and (2) if 

assigned by the procuring contracting officer after contract award, the ACO at the CAO 

who administers the contract, which includes monitoring contractor performance. To 

facilitate its contract administration work, under its decentralized organizational structure, 

DCMA’s divisions have 47 field CAOs and assign “corporate” administrative contracting 

officers to provide oversight at larger contractor facilities, such as those included in this 

study. As of December 2008, DCMA has about 10,000 civilian and military staff overseeing 

almost 19,000 contractors. 

Page 23 GAO-09-591 DOD Contractor Ethics Programs
 

Before the FAR requirements were finalized in 2008—and Congress 

mandated that we report on the extent to which DOD monitors or 

approves defense contractors’ ethics programs—we previously 

recommended in 2005 that DOD needs to obtain more knowledge of 

contractors’ standards of conduct efforts and that enhanced awareness of 

contractor ethics programs would enable DOD to assess whether the 

public trust is protected.34 We recommended that DOD take actions to 

improve its knowledge and oversight of contractors’ ethics programs. DOD 

commented that the recommendation was currently implemented when 

contracting officers make, prior to awarding a contract, an affirmative 

determination of responsibility, which included consideration of the 

potential contractor’s business practices and the potential contractor’s 

integrity. As we then indicated in response to DOD’s comment, more could 

be done through assessments of contractor ethics programs to enhance 

contracting officers’ ability to make such determinations. 

Four years later, with the FAR rules having been significantly expanded, 

DOD has not determined what if any changes are needed to its oversight of 

contractor ethics programs during contract administration. The FAR 

Council disposition in 2007 of public comments received from the initial 

FAR rulemaking process provides some insight into what contractors 

might expect of contracting officials’ oversight of the new ethics program 

requirements. For example, the FAR Council commented that review of 

contractors’ compliance would be incorporated into normal contract 

administration on a discretionary basis, but provided no description on 

how responsibility for that discretionary duty would be assigned or 

exercised.35 If such a review were to be required by DOD guidance, it 

could use the FAR’s framework for contractor ethics program standards to 

begin to provide a basis for DCMA or other contracting officials to verify 

that a contractor has established the type of internal ethics and 

compliance program to be expected. This, in turn, would provide some 

assurance that contractors are following ethics programs as expected by 

the FAR Council to help prevent, detect, and timely disclose contractrelated fraud, waste, and abuse. 

 

34 GAO-05-341. 

35 As part of the rulemaking process, several respondents questioned how the contracting 

officer would verify compliance with the requirements. The FAR Council commented that 

the contracting officer is not required to verify compliance, but may inquire at his or her 

discretion as part of contract administrative duties. 72 Fed. Reg. 65878 (Nov. 23, 2007). 

Page 24 GAO-09-591 DOD Contractor Ethics Programs
 

Beyond the issue of authority, there is no consensus among DOD 

contractor oversight officials on where organizationally such 

responsibility for verifying the implementation of the new FAR ethics 

program requirements during contract administration would be assigned. 

Some of DCMA’s CAO staff that we spoke with at several of DOD’s largest 

contractor facilities said that oversight of contractor ethics program 

compliance would fit into their contract administration area of 

responsibility. Other contractor oversight officials at DOD IG, DCAA, and 

the Office for the Under Secretary of Defense for AT&L told us that 

verifying or monitoring DOD contractor ethics programs would logically 

fit with DCMA’s contract administration services. 

DCMA headquarters officials, however, stated that it is not their agency’s 

functional responsibility to verify compliance with the new contractor 

ethics requirements. One senior DCMA headquarters official indicated that 

it would be better to assign responsibility for this function to DCAA’s 

contract audit services that assess the adequacy of contractor internal 

controls for integrity and ethical values.36 In addition, assigning this 

function to DCMA alone would leave some defense contractors 

unaddressed because DCMA is not delegated management responsibility 

for all defense contracts, according to its headquarters officials.37 Rather, 

CAO staff at DCMA’s field locations oversee just those contracts and 

perform contract administration as assigned to them by procuring 

contracting officers at DOD’s buying offices. Thus, for many of DOD’s 

contractors, the contract administration function is retained by the 

procuring contracting officer. As a result, other contracting officials across 

DOD procuring offices would need to examine any contractors not 

covered by DCMA CAO staff. 

 

36 Under the FAR, however, DCAA’s role is advisory, which means it has less authority than 

DCMA’s CAOs have to require contractor action to correct deficiencies DCMA identifies 

through contract administration. 

37 According to DCMA headquarters’ officials, DCMA’s contract administrative functions do 

not address most of DOD’s services contractors. 

Page 25 GAO-09-591 DOD Contractor Ethics Programs
 

Under the FAR rule effective in December 2007, defense contractors are 

not required to display DOD IG’s fraud hotline posters if the contractors’ 

ethics and compliance programs include reporting mechanisms such as 

their own hotline posters.38 According to a FAR Council response to public 

comments in finalizing the agency hotline display rule in 2007, the 

exemption was to mirror earlier DFARS guidance, which permitted 

contractors to post their own hotline posters, in lieu of DOD hotline 

posters, to provide an outlet for employees to raise issues of concern.39

This exemption has two potential adverse consequences for DOD 

oversight of defense contractors: lessening DOD’s awareness of problems 

and diminishing contractor employee awareness of whistleblower 

protections. 

Not Requiring Display of 

DOD Hotline Posters 

Could Delay or Lessen 

DOD’s Awareness of 

Problems and Use of 

Whistleblower Protections 

The display of the standard hotline posters available to contractors from 

DOD IG, shown in figure 1, at contractor work sites is part of DOD’s 

efforts to fight procurement and other types of fraud, waste, and abuse. 

 

38 Under FAR 52.203-14—Display of Hotline Poster(s), a contractor is exempt from the 

required display of DOD IG’s fraud hotline poster if the contractor has an ethics and 

compliance program that includes a reporting mechanism such as a hotline poster. 

According to the FAR Council, unless an agency’s inspector general requires specific 

requirements and information for posters, there is no need to have multiple agency posters 

if a company has its own internal reporting mechanism. 

39 DFARS Subpart 203.70—Contractor Standards of Conduct, guidance removed by DOD on 

August 12, 2008. 73 Fed. Reg. 46815 (Aug. 12, 2008). 

Page 26 GAO-09-591 DOD Contractor Ethics Programs
 

Figure 1: DOD Hotline Posters Available for Contractor Display 

Source: DOD IG.

In fiscal year 2008 alone, DOD’s hotline received nearly 14,000 contacts 

resulting in 2,000 cases referred for investigation. However, because the 

FAR rule exempts contractors whose ethics programs include their own 

hotlines, and if more contractors opt not to display DOD’s hotline posters, 

there is a risk that defense contractor employees will be unaware and not 

avail themselves of DOD’s hotline. According to our ethics program 

survey, 55 of the 57 contractors report having one or more reporting 

mechanisms, such as a hotline for employees to report known or 

suspected conduct that violates ethics standards or contract requirements. 

The DOD hotline poster’s absence from contractor work sites could also 

jeopardize use of whistleblower protections for contractor employees put 

Page 27 GAO-09-591 DOD Contractor Ethics Programs
 

in place by DOD in response to legislation separate from the development 

of the FAR’s contractor ethics program requirements.40 Under this 

legislation, federal protections were strengthened for contractor 

employees against employer reprisals for blowing the whistle to 

government entities (such as DOD IG through its fraud hotline) on 

suspected gross mismanagement of or illegal activities on a DOD contract. 

The contractor internal reporting mechanisms, such as hotline posters 

required separately under the new FAR rules, do not provide contractor 

employees with the type of whistleblower protections that disclosure to 

DOD IG or to other DOD entities offers.41

Although DFARS, since January 2009, requires contractors to inform their 

employees in writing of these federal whistleblower rights and 

protections,42 without display of DOD’s hotline poster in a contractor work 

site, contractor employees could unwittingly disclose information to the 

company’s internal hotline, where they would not have federal protections 

in the event of employer reprisals. To facilitate contractor employee 

whistleblower protections, senior DOD IG headquarters officials 

responsible for investigations and policy agreed that it might be necessary 

to modify DOD hotline posters for display at contractor work sites to 

inform contractor employees that their federal whistleblower protections 

are limited to disclosures to government entities only. 

According to FAR Council responses to public comments received while 

finalizing the hotline display rule, it is the responsibility of the agency 

inspector general to determine the need for, and the contents of, the fraud 

hotline poster. Given the magnitude of DOD’s contract dollars spent each 

year, with tens of thousands of contractors and ongoing efforts by DOD 

through its Panel on Contracting Integrity to reduce vulnerabilities to 

procurement fraud, we asked DOD IG, DCAA, suspension and debarment, 

 

40 Duncan Hunter National Defense Authorization Act for Fiscal Year 2009, Pub. L. No. 110-

417 § 842 (2008). 

41 Under DOD IG hotline policy, to reduce fear of potential employer reprisal and 

encourage hotline disclosures, the identity of contractor employees who report through the 

DOD hotline is not released without employee permission. DOD IG Mission Briefing 

(Feb. 24, 2009). 

42 DFARS Subpart 203.9. 

Page 28 GAO-09-591 DOD Contractor Ethics Programs
 

and AT&L contractor oversight officials for their views.43 Specifically, we 

asked about the risk of defense contractors not displaying DOD hotline 

posters and whether the hotline poster’s absence in workplaces where 

DOD contracts are performed might impinge on DOD’s ability to timely 

address contractor violations. Several of the DOD oversight officials were 

not aware of the FAR’s exemption regarding display of the DOD hotline 

posters until we told them. 

Once informed, some of these DOD officials expressed concern that the 

hotline poster’s absence was not in the best interest of reducing DOD’s 

vulnerability to procurement fraud. DOD IG officials agreed that changing 

DFARS to require all defense contractors to display the DOD hotline 

poster should occur. Nearly all of the 57 contractors we surveyed appear 

positioned to detect problems because they report having mechanisms 

such as hotlines for employees to report problems. However, the DOD IG 

team leader for military reprisal investigations expressed concern that 

contractor employees may be uncomfortable reporting to their companies’ 

internal hotlines, an indication that relying only on contractor reporting 

mechanisms could also result in DOD not finding out about the problems 

at all. Moreover, relying on contractor mechanisms could also delay DOD’s 

awareness of such problems and its efforts to verify and act on suspected 

violations. For example, under the new FAR rules, the length of time it 

takes a contractor to determine if there is credible evidence of a violation 

subject to mandatory disclosure requirements could affect DOD’s 

awareness of a problem.44 With the DOD hotline, DOD has immediate 

awareness of potential violations from contractor employee calls. While 

there might be practical reasons for continuing to exempt some defense 

contractors with their own hotlines from displaying DOD’s hotline poster, 

 

43 In February 2007, the Under Secretary of Defense for AT&L established the Panel on 

Contracting Integrity, as required by section 813 of the Defense Authorization Act for Fiscal 

Year 2007. The panel, whose executive director is the Director, Defense Procurement and 

Acquisition Policy and Strategic Sourcing, includes more than 20 senior-level procurement 

executives, inspectors general, and other representatives from across DOD. As required by 

the act, DOD has submitted two annual reports to Congress since December 2007 on the 

panel’s findings and recommendations to foster and monitor contracting integrity across 

the department. John Warner National Defense Authorization Act for Fiscal Year 2007, 

Pub. L. No. 109-364 § 813 (2006). 

44 Subsequent to detecting problems through such internal hotlines, in accordance with the 

new FAR rules, contractors are to determine whether there is credible evidence that 

certain contract-related violations have occurred. If the contractor determines there is 

credible evidence, the FAR then requires the contractor’s timely disclosure of violations to 

the agency inspector general. FAR 52.203-13. 

Page 29 GAO-09-591 DOD Contractor Ethics Programs
 

such as avoiding the confusion or duplication that could occur with too 

many hotline posters on display in one place, senior contract policy 

officials in the Office of the Under Secretary of Defense for AT&L believe 

that further study is warranted of possible changes in DFARS to more fully 

protect defense contracting integrity.45

The FAR requirements provide new direction for defense contractor ethics 

programs and present DOD opportunities to improve its oversight of these 

programs. The new rules seek to promote organizational cultures that 

encourage ethical behavior as well as promote compliance with the law. 

Our survey completed in 2009 shows that nearly all of the 57 major 

defense contractors reviewed included many of the ethics program 

practices before the FAR rules were finalized consistent with the 

standards later required for compliance. DOD, in turn, is making positive 

changes to address some of the new FAR requirements. 

Conclusions 

However, additional opportunities exist to improve DOD’s oversight in 

two key areas. The first is in the area of verifying the existence of 

contractor ethics programs after contract award as part of contracting 

officers’ contract administration responsibility. The need for new 

oversight attention and guidance across DOD in the area of contract 

administration has not been clearly identified or determined. Such 

additional oversight of contractor ethics programs during contract 

administration could help ensure that contractor ethics programs are in 

place as intended. 

The second is in the area of DOD’s hotline program, for improved 

oversight for potential contract-related fraud, waste, and abuse. The new 

FAR contractor ethics rules have the potential to make the hotline 

program less effective by ultimately reducing contractor exposure to DOD 

hotline posters and diminishing the means by which fraud, waste, and 

abuse can be reported under the protection of federal whistleblower laws. 

Nearly all of the major contractors surveyed have in-house ethics and 

compliance programs that exempt them from displaying the DOD posters. 

It is conceivable that virtually no major contractor would be required to 

display the DOD hotline posters. Contractor employees might be reluctant 

 

45 According to senior contract policy officials in the Office of the Under Secretary of 

Defense for AT&L, DOD’s Panel on Contracting Integrity could take up consideration of 

this and related matters concerning DOD contracting oversight that are affected by FAR 

changes requiring contractor ethics programs. 

Page 30 GAO-09-591 DOD Contractor Ethics Programs
 

to report violations to an in-house hotline that did not provide federal 

protection against company retaliation. However, employees do have such 

protection when reporting directly to the DOD hotline. 

We are recommending four actions aimed at improving DOD’s oversight of 

defense contractors’ ethics programs. First, to strengthen oversight during 

contract administration, we recommend that the Secretary of Defense 

direct the Under Secretary of Defense for AT&L to determine what if any 

new DFARS or other guidance is needed to clarify functional 

responsibilities of DCMA and other contracting officials during contract 

administration for verifying the implementation of contractor ethics 

programs as required under the FAR ethics rules. 

Recommendations for 

Executive Action 

To avoid delaying or lessening DOD IG awareness of contract-related 

problems and diminishing of whistleblower protections for contractor 

employees, we recommend that the Inspector General for the Department 

of Defense, in accordance with the FAR, take the following two actions: 

• Determine the need for defense contractors’ display of DOD IG’s fraud 

hotline poster, including directing a contractor to display the DOD IG 

hotline poster in common work areas for performance of DOD contracts. 

• Determine the contents of the DOD IG’s fraud hotline poster for display by 

defense contractors, including revising the poster to inform contractor 

employees of their federal whistleblower protections. 

Fourth, if the need for hotline poster display is determined by the 

Inspector General, we recommend that the Secretary of Defense direct the 

Under Secretary of Defense for AT&L to propose revisions to DFARS to 

include policy requiring a contract clause directing a contractor to display 

the DOD IG hotline poster in common work areas for performance of DOD 

contracts. DFARS policy should require a defense contractor’s display of 

the DOD IG fraud hotline poster irrespective of whether that contractor 

has its own internal mechanism, such as a hotline for employees to report 

contract-related improprieties. 

We provided a draft of this report and the e-supplement that accompanies 

it to DOD for comment.46 The Office of the Under Secretary of Defense for Agency Comments 

 

46 The e-supplement, which presents results from the survey of contractor ethics programs, 

can be found on our Web site at http://redesign-www.gao.gov/special.pubs/gao-09-

646sp/index.html. 

Page 31 GAO-09-591 DOD Contractor Ethics Programs
 

AT&L’s Director, Defense Procurement and Acquisition Policy, wrote that 

DOD concurs with the first three recommendations. For example, 

according to the Director, the first recommendation will be referred to the 

Defense Acquisition Regulation (DAR) Council to establish a DFARS case 

to determine whether additional guidance is needed to clarify the 

administrative contracting officer’s functional responsibilities. 

Regarding the last recommendation, the Director wrote that DOD partially 

concurs because it is not necessary (as we recommended) for the Panel on 

Contracting Integrity to propose the revisions. However, in response to 

this recommendation, the Director will submit the proposed revisions to 

DFARS via memorandum to the DAR Council. Since DOD’s comment 

concurs with the substance of the recommendation, we revised it to better 

align with DOD’s preferred method for implementation. DOD’s comments 

are reprinted in appendix II. 

We are sending copies of this report to the Secretary of Defense, the DOD 

Inspector General, the Director of the Office of Management and Budget, 

the major defense contractors identified in this report, and other 

interested parties. The report also is available at no charge on the GAO 

Web site at http://www.gao.gov. 

If you or your staff have any questions about this report, please contact me 

at (202) 512-4841 or needhamjk1@gao.gov. Contact points for our Offices 

of Congressional Relations and Public Affairs may be found on the last 

page of this report. GAO staff who made major contributions to this report 

are listed in appendix IV. 

John K. Needham 

Director, Acquisition and Sourcing Management 

Page 32 GAO-09-591 DOD Contractor Ethics Programs
 

List of Congressional Committees

The Honorable Carl Levin 

Chairman 

The Honorable John McCain 

Ranking Member 

Committee on Armed Services 

United States Senate 

The Honorable Ike Skelton 

Chairman 

The Honorable Howard P. “Buck” McKeon 

Ranking Member 

Committee on Armed Services 

House of Representatives 

Page 33 GAO-09-591 DOD Contractor Ethics Programs
Appendix I: Scope and Methodology Appendix I: Scope and Methodology 

Congress included a provision in the National Defense Authorization Act 

for Fiscal Year 2008 requiring us to report on the internal ethics programs 

of major defense contractors.1

 In January 2009, we briefed the Senate and 

House Armed Services Committees on the preliminary results regarding 

the reporting requirements specified in the act. After this congressional 

mandate, revisions to the Federal Acquisition Regulation (FAR) to require 

internal ethics programs of contractors were finalized. As shown in table 

10’s side-by-side comparison, ethics program elements identified by 

Congress for inclusion in this report are very similar to the contractor 

ethics program elements now required by the FAR. 

Table 10: Comparison of Ethics Program Elements in Congressional Mandate and 

FAR Requirements 

Contractor internal ethics program elements 

Congressional 

mandate 

FAR 

requirements 

Written code of business ethics and conduct X 

Internal mechanisms, such as hotlines, for reporting 

misconduct 

X X 

Notification to employees of external mechanisms, 

such as the Department of Defense (DOD) Inspector 

General (IG) hotline, for reporting misconduct 

X X 

Notification to employees of their right to be free from 

reprisal for disclosing a substantial violation of law 

related to a contract 

X a 

Ethics training programs X X 

Internal audit or review programs X X 

Requirements for self-reporting violations to 

government officials 

X X 

Disciplinary action X X 

Appropriate management oversight X X 

Sources: Section 848 of the National Defense Authorization Act for Fiscal Year 2008 and FAR Subparts 3.10, Clauses 52.203-13, and 

52203-14 (information); GAO (analysis and presentation). 

a

We also reported on contractor employee whistleblower protections, which were addressed in § 846 

(b)(2)(C) of the National Defense Authorization Act for Fiscal Year 2008, Pub. L. No. 110-181, and §

842 (a) of the National Defense Authorization Act for Fiscal Year 2009, Pub. L. No. 110-417 (2008). 

Given the similarity between some of the ethics program elements in our 

congressional mandate and the current FAR requirements, our audit and 

reporting objectives were to (1) describe the extent to which contractors 

 

1

 Section 848(a) required us to report by January 28, 2009, on the internal ethics programs 

of major defense contractors. Pub. L. No. 110-181 § 848 (2008). 

Page 34 GAO-09-591 DOD Contractor Ethics Programs 
Appendix I: Scope and Methodology 

had ethics programs before the finalization of the FAR rules that included 

practices consistent with standards now required by the FAR and 

(2) assess the impact the new FAR rules have on DOD oversight of 

contractor ethics programs. 

Section 848 defined a major defense contractor as any company awarded 

contracts by DOD during fiscal year 2006 in amounts totaling more than 

$500 million. To identify those contractors, we analyzed data on the values 

of contracts awarded to all companies from DOD’s Statistical Information 

Analysis Division. We initially identified 65 contractors, but we eliminated 

six companies that merged or were joint ventures, as well as two foreign 

government entities from our review. Based on our review of DOD’s data, 

we found that the data were sufficiently reliable for the purpose of 

identifying which contractors to include in this report. As a result, we 

identified the 57 contractors meeting the major defense contractor criteria 

to include in our review. As shown in table 11, which ranks the 57 major 

defense contractors by the value of their fiscal year 2006 DOD contract 

awards, these companies accounted for more than half of DOD’s total 

contract awards in 2006—$164.5 billion of the total $295 billion. 

Table 11: Contractors Reviewed by GAO, by Value of Total Contract Awards from 

DOD in Fiscal Year 2006 

Dollars in millions 

Contractor 

Value of DOD 

contract awards Contractor 

Value of DOD 

contract awards 

Lockheed Martin 

Corporation 

$26,620 Shell Oil Company $1,151

Boeing Company 21,721 Alliant Techsystems, 

Inc. 

 1,128

Northrop Grumman 

Corporation 

 16,627 Oshkosh Truck 

Company 

 941

General Dynamics 

Corporation 

 11,942 Rockwell Collins, Inc. 824

Raytheon Company 10,069 Korea Agricultural 

Cooperative 

 761

BAE Systems PLC 6,192 DRS Technologies 730

KBR, Inc. 6,060 Phillips & Jordon, Inc. 705

L-3 Communications 

Holding, Inc. 

 5,197 CACI International, Inc. 681

United Technologies 

Corporation 

 4,453 General Atomic 

Technologies Company

 670

Page 35 GAO-09-591 DOD Contractor Ethics Programs
Appendix I: Scope and Methodology 

Dollars in millions 

Contractor 

Value of DOD 

contract awards Contractor 

Value of DOD 

contract awards 

Science Applications 

International 

Corporation (SAIC) 

 3,211 McKesson Corporation 670

Computer Sciences 

Corporation (CSC) 

 2,884 Valero Energy 

Corporation 

 661

Humana, Inc. 2,642 Thales 657

ITT Corporation 2,522 Aerospace Corporation 654

General Electric 

Company 

 2,328 Mitre Corporation 652

Health Net, Inc. 2,119 Massachusetts Institute 

of Technology 

 640

Triwest Heathcare 

Alliance Company 

 2,022 Dell, Inc. 636

Electronic Data 

Systems Corporation 

 2,008 Cardinal Health, Inc. 635

AM General, LLC 1,944 Syracuse Research 

Corporation 

 613

Agility Logistics 1,838 Chugach Alaska 

Corporation 

 593

Honeywell 

International, Inc. 

 1,679 Refinery Associates of 

Texas 

 577

Textron, Inc. 1,369 Environmental 

Chemical Corporation 

 570

URS Corporation 1,369 Parsons Corporation 526

Amerisourcebergen 

Corporation 

 1,346 Johns Hopkins 

University 

 525

Harris Corporation 1,339 Battelle Memorial 

Institute 

 519

FedEx Corporation 1,303 Shaw Group, Inc. 519

Bechtel Group, Inc. 1,264 Maersk Line Ltd. 516

Booz Allen Hamilton, 

Inc. 

 1,245 Jacobs Engineering 

Group, Inc. 

 505

BP America, Inc. 1,199 Kraft Foods, Inc. 501

Exxon Mobil 

Corporation 

 1,176

Total DOD contract awards to these 57 contractors in 2006 $164,448

Total DOD contract awards to all contractors in 2006 $294,976

Sources: GAO (analysis); DOD (data). 

Note: The dollar value of DOD contract awards in 2006 for each contractor was rounded to the 

nearest million. 

Page 36 GAO-09-591 DOD Contractor Ethics Programs
Appendix I: Scope and Methodology 

We conducted this performance audit from May 2008 through August 2009 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives. 

The scope and methods we used to perform this audit are described in 

greater detail in the remainder of this appendix.2

First Audit Objective To determine the extent to which 57 major defense contractors included in 

our review have internal ethics programs that include certain practices 

consistent with standards now required by the FAR, we designed and 

conducted a Web-based survey of all 57 contractors. To gain an initial 

understanding of the variety and scope of information reasonably available 

on the range of practices used in relation to internal ethics programs, we 

reviewed chapter 8 (Sentencing of Organizations) of the 2007 Federal 

Sentencing Guidelines Manual and government contract management 

publications for information to describe the FAR contractor ethics 

program requirements. We also interviewed officials from government and 

public entities with knowledge in this area, including the Defense Industry 

Initiative on Business Ethics and Conduct, the Ethics Resource Center, 

DOD, and the Department of Justice’s National Procurement Fraud Task 

Force. 

To conduct this survey, we pretested it in July 2008 with Lockheed Martin 

Corporation, Electronic Data Systems Corporation, Agility Logistics, and 

Mitre Corporation to determine if the questions were clear and unbiased, if 

the terminology used to describe the programs was precise, and whether 

the survey questionnaire placed an undue response burden on companies. 

After revising the survey to incorporate pretest comments in August 2008, 

we sent an e-mail to all 57 contractors in early September 2008 with 

instructions for accessing the survey and followed up with 

 

2

 The scope of our review limits our analysis as follows: (1) we limited this review to 57 

major defense contractors and thus our results cannot be generalized as representing all 

defense contractors’ internal ethics programs and (2) we limited our review to selfreported responses and corroborating documentation from contractors on their internal 

ethics programs, which we did not independently verify for implementation or test for 

effectiveness. 

Page 37 GAO-09-591 DOD Contractor Ethics Programs
Appendix I: Scope and Methodology 

nonrespondents by e-mail and telephone to encourage their responses. 

After we closed out the survey on October 24, 2008, congressional 

committee staff requested that we pursue responses from the remaining 

unresponsive contractors, and we contacted the contractors; reopened the 

survey on March 13, 2009, for 5 business days; and obtained their 

responses. 

The multisection survey was designed to address all of the ethics program 

elements identified in Section 848 and those now required by the FAR, as 

shown in table 10’s side-by-side comparison. The survey was organized in 

various sections to obtain contractors’ self-reported information on their 

internal ethics programs in key areas, such as (1) code of business ethics 

and conduct, (2) internal and external mechanisms for reporting 

misconduct, (3) notification to contractor employees of their right to be 

free from reprisal for disclosing a substantial violation of law, (4) ethics 

training programs, (5) internal audits, and (6) appropriate management 

oversight. GAO’s e-supplement, GAO-09-646SP, provides the questions 

used for the survey as well as the aggregated responses. We analyzed 

responses from the 57 contractors that responded to the survey—a survey 

response rate of 100 percent—in comparison to the FAR requirements 

introduced from December 2007 through December 2008. In addition to 

analyzing self-reported information from the survey responses, we 

requested that all 57 contractors send us corroborating documentation to 

review for various practices in their internal ethics programs, including 

practices now required by the FAR, such as management oversight and 

ethics and compliance training. We did not verify implementation or test 

the effectiveness of contractor ethics program practices self-reported 

through our survey. 

We selected a nongeneralizable sample of 4 of the 57 contractors for site 

visits in order to review in detail implementation practices for some of the 

ethics program policies or procedures described in their survey responses, 

such as disciplinary actions, hotline calls, and ethics training programs. 

Our selection criteria in part were whether (1) the contractors were 

ranked among the top 15 contractors in terms of dollar value of DOD 

contracts awarded to them in fiscal year 2006 and (2) their survey 

responses indicated that the contractors had such policies or procedures 

in use. We visited Boeing Company, General Dynamics, Computer 

Sciences Corporation (CSC), and Science Applications International 

Corporation (SAIC) from December 2008 through February 2009 and 

obtained detailed information from senior company officials responsible 

for management of ethics program–related practices described in their 

responses to our survey. 

Page 38 GAO-09-591 DOD Contractor Ethics Programs
Appendix I: Scope and Methodology 

To determine the benefits and challenges contractors face in implementing 

the new FAR requirements, we analyzed contractor views from our Webbased survey. To identify views and perspectives similar to or different 

from those obtained from the survey, we reviewed responses to public 

comments prepared by the FAR Council and published in the Federal 

Register. 

Second Audit Objective To assess the impact that expanded FAR contractor ethics program 

requirements have on DOD monitoring or approval of defense contractor 

ethics programs, we focused on defense and military organizations 

responsible for oversight and investigation of contractor operations and 

improper business practices: (1) Defense Contract Management Agency 

(DCMA); (2) Defense Contract Audit Agency (DCAA); (3) DOD IG; (4) the 

Air Force, Army, and Navy offices responsible for suspension and 

debarment; and (5) the Office of the Under Secretary of Defense for 

Acquisition, Technology and Logistics (AT&L). We interviewed senior 

procurement officials; general counsel; and contract administration, audit, 

and investigative service officials concerning these agencies’ roles and 

responsibilities for monitoring or approving contractor ethics programs. 

Through interviews and information obtained from these officials, we 

obtained views and reviewed supporting documentation concerning the 

impact the new FAR rules have had or could have on DOD contractor 

oversight activities regarding monitoring contractors’ compliance with 

ethics program practices required by the FAR rules. 

In addition, we communicated with selected officials from the DOD 

agencies listed above to obtain updates regarding changes in their policies 

and procedures to implement the expanded FAR requirements, reviewed 

available guidance and instructions these agencies developed to 

implement the FAR changes, and analyzed public comments attributed to 

DOD or other government sources and FAR Council responses published 

in the Federal Register relevant to agencies’ implementation of the 

requirements. We also interviewed senior DCAA and DCMA officials 

colocated at four contractor field office locations to discuss their oversight 

of contractor ethics programs and any concerns they might have related to 

those programs on contractor performance and costs. We did not test 

DOD agencies’ effectiveness in implementing their contractor ethics 

program oversight activities. 

Page 39 GAO-09-591 DOD Contractor Ethics Programs
Appendix II: Comments from the Department Appendix II: Comments from the Department of Defense 

of Defense 

Page 40 GAO-09-591 DOD Contractor Ethics Programs 
Appendix II: Comments from the Department 

of Defense 

Page 41 GAO-09-591 DOD Contractor Ethics Programs
Appendix II: Comments from the Department 

of Defense 

Page 42 GAO-09-591 DOD Contractor Ethics Programs
Appendix III: Required Federal Acquisition 

Regulation Components for Contractor Ethics Appendix III: Required Federal Acquisition Programs 

Regulation Components for Contractor 

Ethics Programs 

The final FAR rule—effective in December 2008—reflects contractor 

ethics program standards across four broad components, as shown in 

table 12.1

 According to the FAR Council, the rule establishes a framework 

for institutional ethics management and disclosure but does not prescribe 

specific ethical requirements. Contractors are free to establish the 

appropriate ethical standards for their businesses. 

Table 12: Required FAR Components for Contractor Ethics Program Practices 

Component requirement Description 

Code of business ethics and 

conduct 

Required for businesses with contracts or subcontracts over $5 million and a period of performance 

of 120 days or more; must be implemented within 30 days of contract award; must be written and 

distributed to all employees. 

Ethics awareness and 

compliance program 

Required for noncommercial item acquisitions and businesses that are other than “small” and with 

contracts or subcontracts over $5 million and a period of performance of 120 days or more; must be 

implemented within 90 days of contract award. The ongoing program shall include steps to 

periodically communicate the contractor’s business ethics standards and procedures by conducting 

training programs for all employees. 

Internal control system—Required for noncommercial item acquisitions and businesses that are other than “small” and with 

contracts or subcontracts over $5 million and a period of performance of 120 days or more. Among others, minimum practices 

required for the contractor’s internal control system include the following. 

High level of management 

oversight 

Assignment of high-level responsibility within the organization and adequate resources for the ethics 

and compliance program. 

Periodic reviews, audits, or 

both 

Required to evaluate effectiveness of company business practices, procedures, and policies, and 

internal controls for compliance with the established code of business ethics and conduct and the 

special requirements of government contracting. 

Internal mechanism for 

reporting misconduct 

Mechanisms, such as a hotline, for employees to report anonymously or confidentially suspected 

instances of improper conduct and instructions that encourage employees to make such reports. 

Unless the contract is performed entirely outside the United States or is for commercial items, a 

contract clause may also be used to require display of agency fraud hotline posters, but the 

contractor need not do so if it has implemented an ethics program with an internal reporting 

mechanism, such as a hotline poster of its own. 

Disciplinary systems Follow through with disciplinary action for improper conduct or failing to take reasonable steps to 

prevent or detect improper conduct; exclude an individual as a principal who has engaged in conduct 

in conflict with the established code of ethics. 

Timely disclosure In connection with the award, performance, or closeout of a contract or subcontract, mandatory 

reporting of credible evidence of violations of (1) federal criminal law involving fraud, conflict of 

interest, bribery, or gratuity violations found in Title 18 of the U.S. Code or (2) the civil False Claims 

Act. For contracts or subcontracts over $5 million and a period of performance of 120 days or more, 

as required by contract clause, they shall timely disclose these violations of federal criminal law and 

the civil False Claims Act in writing to the agency Office of the Inspector General with a copy to the 

contracting officer. 

Sources: FAR Subpart 3.10, clauses 52.203-13, and 52.203-14 (information); GAO (analysis and presentation). 

 

1

 73 Fed. Reg. 67064-93 (Nov. 12, 2008). 

Page 43 GAO-09-591 DOD Contractor Ethics Programs 
Appendix IV: GAO Contact and Staff Appendix IV: GAO Contact and Staff Acknowledgments 

Acknowledgments 

John K. Needham (202) 512-4841 or needhamjk1@gao.gov 

Carolyn Kirby, Assistant Director 

Erin Schoening, Analyst in Charge 

Myra Watts Butler, Senior Analyst 

Gwyneth Woolwine, Senior Analyst 

Erin Stockdale, Analyst 

Aglae Cantave, Analyst 

Ryan Stott, Analyst Intern 

Greg Campbell, Senior Communications Analyst 

Jean McSween, Senior Social Science Analyst 

Walter Vance, Senior Social Science Analyst 

John Krump, Deputy Assistant General Counsel 

Page 44 GAO-09-591 DOD Contractor Ethics Programs

GAO Contact 

Acquisition and 

Sourcing Management 

Applied Research and 

Methods 

General Counsel 

(120736) 
GAO’s Mission The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday afternoon, GAO 

posts on its Web site newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.” 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s Web site, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information. 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, DC 20548 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

Public Affairs 

Please Print on Recycled Paper