Defense Contracting Integrity: Opportunities Exist to Improve DOD's Oversight of Contractor Ethics Programs
Published: 2009-09-22T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Until recently, ethics programs and practices of defense contractors were self-policed. Given the significant sums spent to acquire goods and services, the Federal Acquisition Regulation (FAR) was amended twice starting in December 2007 to first mandate and later amplify contractor ethics program rules. Before FAR changes were finalized in December 2008, Congress required GAO to report in 2009 on the ethics programs of major defense contractors. This report (1) describes the extent that contractors had ethics programs before the finalization of the FAR rules that included practices consistent with standards now required by the FAR and (2) assesses the impact the new FAR rules have on Department of Defense (DOD) oversight of contractor ethics programs. To do this work, in September 2008 GAO surveyed all 57 contractors--those receiving more than $500 million in 2006 DOD contract awards--and interviewed DOD contractor oversight agency officials on the impact of the new FAR rules on oversight.
section_title: What GAO Found
paragraphs: All 57 contractors responded to GAO's survey, and 55 reported having ethics programs that include many of the practices consistent with standards now required for compliance with the FAR. The ethics practices information GAO obtained was from before the FAR rules were finalized and thus was not designed to test contractor compliance with the rules that came later. In response to the new FAR rules, DOD has made two key oversight improvements by revising its contract audit guidance to cover the new ethics requirements and establishing the Contractor Disclosure Program to implement the mandatory disclosure requirement. However, opportunities exist to improve DOD's oversight in two other key areas. For example, in verifying implementation of contractor ethics programs during contract administration, the impact of the FAR rules on oversight at this point is negligible. GAO found that DOD had no plans to change contract administration offices' oversight because authority for oversight is not explicit nor is organizational responsibility clear. Also, with regard to contractors' hotline poster displays, the new FAR rules could reduce DOD's awareness of potential violations. The rules exempt contractors with ethics programs that include their own hotlines from the requirement to display DOD hotline posters. If contractor employees report violations to company hotlines instead of DOD hotlines, the employees do not receive the same protections from whistleblower laws. Whistleblower protections for employees unaware of the DOD hotline could be jeopardized.

section_title: Letter
paragraphs: In fiscal year 2008, the Department of Defense (DOD) spent more than  $387 billion for goods and services from more than 85,000 contractors.  Given the magnitude of taxpayer money at stake, it is essential that  defense contractors conduct their business operations with integrity. In  the last several years there have been a number of cases of fraud, waste,  and abuse in wartime contracting and even some high-profile criminal and  civil convictions of large defense contractors because of procurement  integrity and foreign corrupt practices violations. These procurement  fraud cases heightened concerns in Congress and the executive branch  about the adequacy of defense contractors’ ethics programs in preventing  or addressing misconduct that could put billions of dollars of contracted  goods and services at risk.
In the past, DOD’s policy under the Defense Federal Acquisition  Regulation Supplement (DFARS) encouraged contractors to have written  ethics policies and recommended practices, such as ethics training for all  employees and hotlines or other internal mechanisms for them to report  suspected misconduct. Essentially, defense contractor ethics programs  were voluntary and self-policed. Moreover, our prior work raised concerns  that DOD lacked adequate oversight of its contractors’ ethics programs,  recommending that enhanced knowledge of contractor ethics programs  would enable DOD to assess whether the public trust is protected.
Given the significant sums of federal dollars spent by agencies to acquire  goods and services, and the need to establish a clear and consistent policy  regarding contractor code of ethics and business conduct, the Federal  Acquisition Regulation (FAR) was amended twice to address contractor  ethics programs. In December 2007 and again in December 2008, the FAR  was amended first to mandate and then to amplify governmentwide ethics  program requirements for certain contractors. Contractors’ internal  programs must now include an ethics and compliance system with several  practices aimed at preventing and detecting misconduct and at promoting  an organizational culture that encourages ethical conduct and a  commitment to compliance with the law. Before FAR changes were  finalized in late 2008, Congress included a provision in the National  Defense Authorization Act for Fiscal Year 2008 requiring us to report on  the internal ethics programs of major defense contractors—defined as any  company that received more than $500 million in DOD contract awards in  fiscal year 2006—and the extent to which DOD monitors or approves  them. In January 2009, we briefed your committees on the preliminary  results regarding the reporting requirements specified in the act. Taking  into consideration the new FAR contractor ethics program rules, which  are very similar to some of the reporting requirements specified in the act,  this report (1) describes the extent to which contractors had ethics  programs before the finalization of the FAR rules that included practices  consistent with standards now required by the FAR and (2) assesses the  impact the new FAR rules have on DOD oversight of contractor ethics  programs.
To select contractors for review, we used DOD’s contract award data and  identified 57 major defense contractors receiving more than $500 million  in fiscal year 2006 for review. To obtain information on contractor ethics  programs and practices, in September 2008 we surveyed all 57 contractors.  We also obtained corroborating documentation for various practices— including those consistent with the FAR’s standards, such as management  oversight and ethics and compliance training—and information about the  benefits to contractors and the challenges they face in implementing the  new FAR ethics rules. We analyzed responses from all 57 contractors and  reviewed the FAR Council’s disposition of public comments considered as  part of the rulemaking process for additional perspectives on benefits to  contractors and challenges they face implementing new ethics program  rules. While we reviewed the contractors’ self-reported practices for  consistency with the FAR rules that came later, we did not test them for  effectiveness or compliance. We selected a nongeneralizable sample of  four contractors for site visits in order to review in detail implementation  practices for some of the ethics program policies or procedures described  in their survey responses. We chose these four contractors because   (1) they ranked among the top 15 contractors in terms of dollar value of  fiscal year 2006 DOD contract awards and (2) their survey responses  indicated that they had such policies or procedures in use.
To assess the impact the new FAR contractor ethics rules have on DOD,  we focused on defense and military organizations responsible for  oversight and investigation of contractor operations and improper  business practices. These organizations included the (1) Defense Contract  Management Agency (DCMA); (2) Defense Contract Audit Agency  (DCAA); (3) DOD Office of the Inspector General (DOD IG); (4) Air Force,  Army, and Navy offices responsible for suspension and debarment; and   (5) Office of the Under Secretary of Defense for Acquisition, Technology  and Logistics (AT&L). We interviewed senior procurement officials;  general counsel; and contract administration, audit, and investigative  service officials concerning these agencies’ roles and responsibilities for  monitoring or approving contractor ethics programs. Through interviews  and information obtained from these officials, we obtained views and  reviewed supporting documentation concerning the impact the new FAR  rules have had or could have on DOD contractor oversight activities  related to monitoring contractors’ compliance with ethics program  practices required by the new rules. We did not test DOD agencies’  effectiveness in implementing their oversight activities related to  monitoring contractor ethics programs.
We conducted this performance audit from May 2008 through August 2009  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. Appendix I provides additional  details on our scope and methodology, including a list of the 57  contractors reviewed.
subsections: section_title: Background
subsections: section_title: Defense Contractor Ethics Programs and DOD Oversight before New FAR Rules
paragraphs: Before the FAR changes in December 2007, DFARS provided that  contractors must conduct themselves with the highest degree of integrity  and honesty. Specifically, defense regulations provided that contractors  should have (1) a written code of ethical conduct; (2) ethics training for all  employees; (3) periodic reviews of compliance with their code of ethical  conduct; (4) internal audits, external audits, or both; (5) disciplinary  action for improper conduct; (6) timely reporting to appropriate  government officials of any suspected violation of law regarding  government contracts; and (7) full cooperation with any government  agencies responsible for either investigation or corrective action. While  defense regulations provided that contractors should have such elements,  they were not mandatory. As a result, under DFARS and until the FAR  rules established mandatory ethics program requirements, DOD relied on  contractor self-governance—through which a company decided if and how  to implement and enforce ethical conduct.
Oversight and management of DOD contracting activities is shared among  various organizations. Collectively, these organizations help detect  instances of fraud, waste, and abuse; try to prevent them from happening;  or are involved in correcting policies and procedures when they occur.  For example, the Office of the Under Secretary of Defense for AT&L  provides policy, guidance, and oversight to acquisition functions. Other  DOD organizations may examine contractors’ ethics programs under a  range of authorities for contract administration and audit services. Table 1  shows DOD organizations involved in overseeing and managing  contracting activities and their primary responsibilities in examining  contractors’ ethics programs.
section_title: Concerns over Procurement Fraud Trends Prompt FAR Contractor Ethics Rules
paragraphs: A number of cases involving fraud in wartime contracting in Iraq, Kuwait,  and Afghanistan and recent scandals involving high-profile defense  contractors have prompted significant changes in procurement fraud  investigations, enforcement initiatives, legislation, and regulation. By 2007,  in view of the trend, the FAR Council commented that the DFARS  provision that contractors should have specific elements of an ethics  program was no longer considered strong enough to increase contractor  compliance with ethical rules of conduct.
To address this problem, the FAR Council changed the regulations. After  conducting an extensive proposed rulemaking and public comment  process from February 2007 through November 2008, the FAR Council  twice amended the FAR to impose new ethics requirements on  government contractors. The initial rule—effective in December 2007— created a new FAR subpart that requires government contractors to have  written codes of business ethics and ethics compliance training programs  for contractor employees and to post “fraud hotline” posters at contractor  work sites to encourage contractor employees to report fraudulent activity  in connection with performance and award of government contracts.
However, in December 2008 certain shortcomings in the initial contractor  ethics rules were addressed in further amendments to the FAR. For  example, public concerns over the first rule’s exemption connected to  overseas contracting prompted elimination of this exemption in the  second rule, and as of December 2008, overseas and commercial  contractors are now required to maintain written codes of business ethics  and conduct. In addition, the amended FAR contractor ethics rules now  require contractors to disclose violations of criminal law involving fraud,  conflict of interest, bribery, or gratuity violations or violations of the civil  False Claims Act (31 U.S.C. 3729-3733) in connection with award or  performance of government contracts and subcontracts. It should be  noted that these requirements are implemented by contract clause and are  mandatory. The amended rules also specifically subject contractors to  suspension and debarment from government contracting for knowingly  failing to disclose such violations and failing to disclose receipt of  overpayments on government contracts in a timely manner.
The FAR changes effective in December 2008 also enhance provisions for  sound ethics business practices by specifically requiring the establishment  of internal control systems for  facilitating discovery of improper conduct,    ensuring that corrective measures are promptly carried out, and    otherwise promoting an organizational culture that encourages ethical  conduct and a commitment to compliance with the law.
In publishing the December 2008 rule’s amplified requirements, the FAR  Council stated that the U.S. Sentencing Commission’s federal sentencing  guidelines are the source of the FAR text, which provides guidance for  contractors consistent with the guidelines on effective compliance and  ethics programs for organizations. Among other things, the sentencing  guidelines state that an ethics and compliance program should be  reasonably designed, implemented, and enforced so that it is generally  effective in preventing and detecting criminal conduct. Notably, the  sentencing guidelines also state that the failure to prevent or detect a  particular offense does not necessarily mean that the program is generally  ineffective in preventing and detecting criminal conduct.
According to the FAR Council, the final rule reflects standards across four  broad components and establishes a framework for institutional ethics  management and disclosure, but does not prescribe specific ethical  requirements. Contractors are free to establish the appropriate ethical  standards for their businesses. For a more detailed description of the final  rule’s establishment of standards across four broad components, see  appendix II.
section_title: Contractors Report Using a Range of Ethics Program Practices Now Required by the FAR
paragraphs: In September 2008 and before the FAR rules were finalized, to identify  contractor ethics program practices, we surveyed all 57 contractors to  obtain information on the extent to which their programs included  practices required or proposed in the FAR or otherwise addressed in  congressional requirements for this report. As summarized in table 2,  nearly all of the 57 contractors responding to our survey report using  many of the ethics practices consistent with standards now required by  the FAR. The ethics program practices information we obtained was not  designed to test contractor compliance with the rules that came later.
Views of contractors surveyed were mixed with regard to the benefits and  challenges they face in implementing the FAR contractor ethics rules.  Contractors responding to our survey cited several expected benefits and  challenges of the new ethics rules. Other benefits and challenges were  attributed by the FAR Council to public comments from contractor  industry and other sources when finalizing the new FAR contractor ethics  rules in 2008. Some of these benefits and challenges are highlighted in  table 3.
With regard to the new FAR rule’s mandatory timely disclosure of certain  contract-related violations of criminal law or the False Claims Act, several  contractors responding to our survey as well as industry concerns cited in  public comments indicated that contractors would face significant  difficulty in implementing those requirements. In response to these  concerns, the FAR Council revised key aspects of the final rule regarding  timely disclosure, including to    more closely focus the situations that must be disclosed by limiting  violations of criminal law to certain violations involving fraud, conflict of  interest, bribery, or gratuity violations that have occurred in connection  with the award, performance, or closeout of a contract or subcontract;    make “credible evidence” the standard for when timely disclosure should    add clarification that if a violation relates to more than one government  contract, the contractor may make the disclosure to the agency officials  responsible for the largest dollar value contract affected by the violation;  and  limit the application of suspension or debarment to undisclosed  overpayment cases in which the amount is significant.
subsections: section_title: Contractors’ Ethics Program Practices
paragraphs: Highlighted below is some of the aggregated analysis resulting from the  survey about contractors’ ethics practices. A more complete tabulation of  survey questions together with tables indicating the levels of response can  be found in the e-supplement to this report, found on our Web site at  http://redesign-www.gao.gov/special.pubs/gao-09-646sp/index.html.
subsections: section_title: Nearly All Contractors Report Having a Code of Business Ethics and Conduct
paragraphs: One purpose of a code of conduct can be to communicate a company’s  statement of ethical values and integrity as established by top leadership.  Although the FAR does not specify what topics a contractor must include  in its code of conduct, they can cover a broad range of business ethics and  conduct standards, such as conflict of interest, relationships with vendors,  and compliance with government contracting requirements for  procurement integrity, classified information, and recruiting and  employing current or former government personnel, according to sources  on government contractor ethics practices. As shown in table 4, nearly all  of the contractors reported using such practices.
One purpose of ongoing contractor ethics awareness and compliance  programs can be to promote conformance with the code of business ethics  and requirements. Such programs should include reasonable steps to  communicate periodically to employees about the contractor’s ethics  standards and procedures via training programs and communicating  information on individuals’ roles and responsibilities under the ethics  program. As shown in table 5, nearly all of the contractors reported  including steps such as requiring ethics training and periodically  communicating ethics-related information to employees working on DOD  contracts.
All 41 contractors that reported having overseas contract operations  indicated that they had incorporated their ethics awareness and  compliance programs overseas. However 26 contractors reported  experiencing challenges implementing ethics programs overseas, including  differences in legal and regulatory environments relating to, for example,  employee privacy, cultural and language barriers, and technical or hostile  conditions impeding computer-based training.
section_title: Internal Control Systems
paragraphs: Having contractors implement internal control systems increases the  likelihood that their ethics and compliance programs are generally  effective in preventing, detecting, and addressing contract-related fraud,  waste, and abuse. Nearly all of the contractors in our survey reported  using internal control practices consistent with the FAR’s standards.
High-level of management oversight. By assigning responsibility at a  sufficiently high level and providing adequate staffing to ensure the  effectiveness of the ethics program, a contractor can demonstrate true  interest and involvement of management. As shown in table 6, most  contractors report formally assigning responsibility and staff resources to  an office or individual and several have their ethics managers report on a  regular basis to top management. Site visits with four contractors showed  that all had ongoing and active high-level management oversight of their  ethics programs.
Periodic reviews and audits. An internal control system should be  reviewed regularly from a compliance perspective through periodic risk  assessments and audits. Most of the contractors reported a range of  practices for periodic reviews and audits, as shown in table 7. In the case  of our four site visits, we confirmed that all four contractors had internal  audits or reviews of their ethics program as recently as 2008. Examples of  risk areas addressed by these contractors’ internal ethics program audits  include procurement integrity, foreign corrupt practices, and compliance  with the code of conduct and policy for employee background checks.
Internal mechanism for reporting misconduct. Having and publicizing a  system such as a hotline through which employees can anonymously and  confidentially report or seek guidance facilitates detecting and addressing  unethical and illegal activity related to contracts and helps promote a  culture that encourages ethical conduct and a commitment to compliance  with the law. As shown in table 8, most of the contractors reported  having such mechanisms and policies for employees to anonymously or  confidentially report suspected misconduct and contract-related  violations.
In addition, of the 57 contractors responding to our survey, 45 reported  using one or more mechanisms (for example, posters or training) to let  employees know about external mechanisms for reporting contract- related misconduct, such as DOD IG’s hotline, and 55 reported notifying  employees of their federal whistleblower protections through one or more  mechanisms, such as their ethics codes or training.
Disciplinary systems. A disciplinary system is part of providing  appropriate incentives to perform in accordance with the ethics and  compliance program and further demonstrates appropriate follow-through  in investigating, disciplining, and correcting ethics violations. As shown  in table 9, 53 of the 57 contractors report including a disciplinary system in  their ethics programs, with consequences ranging from warning to  termination practices. To ensure that prompt corrective measures are  carried out when violations are substantiated, 35 of the contractors  reported such practices as having specific offices or individuals, while 12  reported having committees, responsible for coordinating and tracking  that appropriate discipline is administered. Site visits with 4 contractors  confirmed that all 4 kept extensive records for management to track and  oversee disciplinary actions by category of conduct violation, employee  category, and business unit.
Since the FAR rule mandating timely disclosure of contractors’ credible  evidence of violations was not yet in effect at the time of our survey, we  asked contractors about policies for voluntarily disclosing to DOD  conduct in connection with defense contracts that may violate applicable  requirements of law or regulation. Of the 57 contractors responding to the  survey, 39 indicated that they had self-reporting policies. Of these, 34 said  that their policy was to voluntarily disclose or self-report violations to  government officials, such as DOD IG, contracting officers, DCMA, and  DCAA. Fifteen of these contractors provided copies of their self-reporting  policies. Of the 18 that indicated that they did not have self-reporting  policies, 10 said it was their practice to self-report or voluntarily disclose,  or to encourage the practice of self-reporting, violations to government  officials. In addition, some of the contractors that had self-reporting  policies reported that the types of contract-related violations subject to  their self-disclosure policies and practices included    violations of law and instances of significant employee misconduct,  instances where there may have been overbilling caused by employee  mischarging and other instances of misconduct,    violation of the Anti-Kickback Act of 1986,    compromise of product integrity,    violations of federal procurement law,    violations that added costs to the government,    cost accounting violations, and    suspected fraud.
Notably, in site visits with four contractors following the November 2008  publication of the FAR’s mandatory rule for timely disclosure of certain  contract-connected violations, senior ethics program managers provided  us information showing that all organizations were changing their  voluntary disclosure policies to implement this new FAR requirement.
section_title: New FAR Rules May Improve DOD Oversight of Contractor Ethics Programs in Some Areas but Not Others
paragraphs: In response to the new FAR rules, DOD has made changes in two key  areas that could improve oversight of contractor ethics programs.  Specifically, DCAA revised its contract audit guidance to cover the new  FAR ethics requirements. In addition, DOD IG established the new  Contractor Disclosure Program to implement the new mandatory  disclosure requirement. However, additional opportunities exist to  improve DOD’s oversight in two other key areas. For example, in a third  area DOD has not assigned responsibility for verifying implementation of  contractor ethics programs during contract administration. The impact of  the FAR rules on oversight at this point is negligible because the authority  for oversight is not explicit nor is organizational responsibility clear. In a  fourth area—hotline poster displays—the new FAR rules could have the  adverse consequence of reducing DOD’s awareness of potential ethics  violations. Under the rules, contractors have been exempted from the  requirement to display DOD hotline posters if they have their own internal  hotlines. This is important because if contractor employees make reports  of contract-related fraud, waste, and abuse to the company hotlines  instead of DOD hotlines, DOD will be less aware of potential problems. In  addition, if employees use contractor hotlines instead of DOD hotlines, the  employees do not receive the same protections from whistleblower laws.
subsections: section_title: DCAA Developed New Audit Guidance on Internal Controls for Contractor Integrity and Ethical Values
paragraphs: Although DCAA provides a range of services to contracting officers and  other DOD officials, DCAA’s primary function is contract audit services.  As part of its ongoing oversight of contractor performance during the  contract administration phase, DCAA’s field audit offices conduct periodic  audits of contractor internal control systems. In carrying out such contract  audits, DCAA personnel are to follow the standards, policies, and  techniques prescribed in the DCAA Contract Audit Manual (CAM).
Senior headquarters policy and planning managers responsible for DCAA’s  auditing standards indicated that the impact of the FAR contractor ethics  rules on DCAA contract audits has been to improve audit guidance. To  incorporate the December 2008 FAR ethics rules into its audits of  contractor controls for integrity and ethical values, in July 2009 the agency  distributed to its field audit offices revisions of a section of the CAM and  its associated audit program. Earlier in June 2009, when the Chief,  Auditing Standards Division updated us on the status of extensive  revisions then under way to improve the CAM audit guidance, she  indicated that the revised guidance under development would integrate  the new FAR standards into DCAA’s auditing program. This was a change  by DCAA since February 2009 when headquarters officials told us that  they planned to make only minor changes. In their view, this was because  many of the new FAR requirements were already in the DFARS section  upon which the earlier audit program was based.
When we subsequently discussed preliminary findings to that effect in  June 2009, the Chief, Auditing Standards Division told us that the agency  had reconsidered its approach and was then proceeding to develop much  more extensive audit guidance revisions than what had earlier been  anticipated. In July 2009, DCAA provided us with its revised audit  guidance, including the section of the CAM on controls for contractor  integrity and ethical values and the associated audit program. DCAA’s new  guidance now integrates the FAR standards into DCAA’s auditing program  for identifying potential internal control deficiencies in contractors’ ethics  and compliance programs.
section_title: DOD IG Established Contractor Disclosure Program as Required by New FAR Rule
paragraphs: The new FAR rule’s requirement that contractors timely disclose credible  evidence of certain violations of federal criminal law or violations of the  civil False Claims Act made it necessary in December 2008 for DOD IG to  replace its Voluntary Disclosure Program with the new Contractor  Disclosure Program. According to the program’s manager, DOD’s new  contractor disclosure process provides    contractors with Web-based and alternative means to report violations in    coordinated evaluation of criminal, civil, and administrative actions with  Department of Justice (DOJ) and DOD stakeholders (including offices for  the Army, Navy, and Air Force suspension and debarment authorities and  buying agencies or weapon systems affected by the disclosure);    a framework for the government to verify and, when appropriate, act on  certain violations discovered through contractor self-policing; and    centralized management combined with decentralized execution and  faster turnaround of the investigative and prosecution processes.
To implement the new FAR rules, DOD took immediate steps—none of  which existed under the Voluntary Disclosure Program—to direct  reporting of all contractor disclosures to the Contractor Disclosure  Program. DOD IG also made early instructions available to contractors  on submitting information via the Contractor Disclosure Program Web site  and, in February 2009, issued a contractor’s guide to submitting a  disclosure. The guide states that disclosures are made with no advance  agreement regarding possible DOD resolution of the matter and with no  promises from DOJ regarding potential civil or criminal actions. In the  event of disclosures of potential criminal liability, however, prompt  disclosure, full cooperation, complete access to necessary records,  restitution, and adequate corrective actions are key indicators to DOD of  an attitude of contractor integrity. DOD IG is also developing  instructions—to be issued in 2009—to provide internal guidance on  various DOD contractor oversight agencies’ roles and responsibilities  under the Contractor Disclosure Program. The instructions call on the  agencies to extensively coordinate and share management of the  investigation/prosecution processes.
Before the new program, the DOD Voluntary Disclosure Program— administered by DOD IG since 1986—had been largely ignored by  contractors for the past 10 years, according to comments received by the  FAR Council from DOJ and inspectors general. The number of contractor  disclosures to the Voluntary Disclosure Program fell steeply over its 22- year history, declining from about 40 to 60 voluntary disclosures accepted  per year in its early years to only 9 voluntary disclosures accepted in  2008. According to the program’s manager, in the first 7 months since the  mandatory program’s start-up in December 2008, DOD has received 41  disclosures from contractors.
DOD IG headquarters officials told us that the agency will include  information on the Contractor Disclosure Program—such as the volume,  nature, and disposition of active and closed disclosure cases—as part of  its semiannual report to Congress.
section_title: New FAR Rules Do Not Call for Verifying Implementation of Contractor Ethics Programs during Contract Administration
paragraphs: The FAR does not specifically require contracting officials to conduct  oversight of contractors’ ethics programs during contract administration,  for example, verifying that the contractor has implemented the new  mandatory contractor business ethics requirement. In contrast, in certain  other areas of the acquisition process the FAR provides guidance for  contracting personnel regarding contractor oversight that could serve as a  model for DOD to use in considering whether to step up oversight of  contractor ethics programs during contract administration. This guidance  identifies several areas for which express responsibility is assigned to  contracting officials for verifying contractor compliance with applicable  laws and regulations. These areas include activities related to  environmental practices and a drug-free workplace. In addition, guidance  is provided to contracting personnel regarding, as applicable, quality  assurance and safety, both of which are cited in the FAR as general  standards for determining whether a prospective contractor is responsible,  just as having a satisfactory record of integrity and business ethics is a  responsibility standard. Such oversight during contract formation and  administration is done, in part, to avoid any adverse impacts on contract  performance or cost after contract award.
As DOD’s lead contract administration agency, DCMA provides a range of  services to contracting officers and other DOD officials after contract  award. If assigned to do so by a contracting officer as part of DCMA’s  contract administration responsibilities after contract award, DCMA  monitors contractor performance and management systems to ensure that  cost, quality, and schedule are in compliance with the terms and  conditions of the contracts. DCMA’s monitoring is primarily performed  by an administrative contracting officer (ACO) located in the field at a  contract administration office (CAO) who is assigned to administer the  contract with assistance from engineers and other specialists at DCMA.  To specifically combat procurement fraud with a strong focus on assisting  CAOs through coordination of remedies and process improvement, DCMA  also has a Contract Integrity Center—operated by its Office of General  Counsel—with attorneys geographically dispersed across the United  States. According to DCMA, these contracting integrity attorneys work  full-time on the prevention, detection, investigation, and prosecution of  allegations of procurement fraud and other misconduct.
Despite DCMA having the important role of performing contract  administration services for many of DOD’s contracts after award, the  impact of the new FAR rules on changing the CAO function to include  some degree of oversight to verify implementation of contractor ethics  programs has been negligible. For example, most of the nine CAO staff we  talked to who provide ongoing contract administration and oversight of  seven major DOD contractors told us that they may receive information  from the contractors or from DCAA on the status of contractors’ ethics  programs. In addition, they monitor contractor ethics program actions to  correct internal control deficiencies for integrity and ethical values in  response to deficiencies discovered during DCAA audits. However, other  than reacting as information comes to them from the contractor and  DCAA, the CAO staff indicated that they were not planning to routinely  verify contractor ethics program efforts. Some of these staff indicated that  they were willing to monitor contractors’ ethics programs but noted that it  is currently not required by the FAR. Some staff indicated that if such a  task was required, criteria or instructions on what to look for would be  needed. However, the new FAR rules are silent with regard to contracting  officer review or standards for examining contractor ethics programs  during contract administration. As such, without further guidance, CAO  staff will continue as before the new FAR rules were implemented with  limited oversight of contractors’ ethics programs.
Before the FAR requirements were finalized in 2008—and Congress  mandated that we report on the extent to which DOD monitors or  approves defense contractors’ ethics programs—we previously  recommended in 2005 that DOD needs to obtain more knowledge of  contractors’ standards of conduct efforts and that enhanced awareness of  contractor ethics programs would enable DOD to assess whether the  public trust is protected. We recommended that DOD take actions to  improve its knowledge and oversight of contractors’ ethics programs. DOD  commented that the recommendation was currently implemented when  contracting officers make, prior to awarding a contract, an affirmative  determination of responsibility, which included consideration of the  potential contractor’s business practices and the potential contractor’s  integrity. As we then indicated in response to DOD’s comment, more could  be done through assessments of contractor ethics programs to enhance  contracting officers’ ability to make such determinations.
Four years later, with the FAR rules having been significantly expanded,  DOD has not determined what if any changes are needed to its oversight of  contractor ethics programs during contract administration. The FAR  Council disposition in 2007 of public comments received from the initial  FAR rulemaking process provides some insight into what contractors  might expect of contracting officials’ oversight of the new ethics program  requirements. For example, the FAR Council commented that review of  contractors’ compliance would be incorporated into normal contract  administration on a discretionary basis, but provided no description on  how responsibility for that discretionary duty would be assigned or  exercised. If such a review were to be required by DOD guidance, it  could use the FAR’s framework for contractor ethics program standards to  begin to provide a basis for DCMA or other contracting officials to verify  that a contractor has established the type of internal ethics and  compliance program to be expected. This, in turn, would provide some  assurance that contractors are following ethics programs as expected by  the FAR Council to help prevent, detect, and timely disclose contract- related fraud, waste, and abuse.
Beyond the issue of authority, there is no consensus among DOD  contractor oversight officials on where organizationally such  responsibility for verifying the implementation of the new FAR ethics  program requirements during contract administration would be assigned.  Some of DCMA’s CAO staff that we spoke with at several of DOD’s largest  contractor facilities said that oversight of contractor ethics program  compliance would fit into their contract administration area of  responsibility. Other contractor oversight officials at DOD IG, DCAA, and  the Office for the Under Secretary of Defense for AT&L told us that  verifying or monitoring DOD contractor ethics programs would logically  fit with DCMA’s contract administration services.
DCMA headquarters officials, however, stated that it is not their agency’s  functional responsibility to verify compliance with the new contractor  ethics requirements. One senior DCMA headquarters official indicated that  it would be better to assign responsibility for this function to DCAA’s  contract audit services that assess the adequacy of contractor internal  controls for integrity and ethical values. In addition, assigning this  function to DCMA alone would leave some defense contractors  unaddressed because DCMA is not delegated management responsibility  for all defense contracts, according to its headquarters officials. Rather,  CAO staff at DCMA’s field locations oversee just those contracts and  perform contract administration as assigned to them by procuring  contracting officers at DOD’s buying offices. Thus, for many of DOD’s  contractors, the contract administration function is retained by the  procuring contracting officer. As a result, other contracting officials across  DOD procuring offices would need to examine any contractors not  covered by DCMA CAO staff.
section_title: Not Requiring Display of DOD Hotline Posters Could Delay or Lessen DOD’s Awareness of Problems and Use of Whistleblower Protections
paragraphs: Under the FAR rule effective in December 2007, defense contractors are  not required to display DOD IG’s fraud hotline posters if the contractors’  ethics and compliance programs include reporting mechanisms such as  their own hotline posters. According to a FAR Council response to public  comments in finalizing the agency hotline display rule in 2007, the  exemption was to mirror earlier DFARS guidance, which permitted  contractors to post their own hotline posters, in lieu of DOD hotline  posters, to provide an outlet for employees to raise issues of concern.  This exemption has two potential adverse consequences for DOD  oversight of defense contractors: lessening DOD’s awareness of problems  and diminishing contractor employee awareness of whistleblower  protections.
The display of the standard hotline posters available to contractors from  DOD IG, shown in figure 1, at contractor work sites is part of DOD’s  efforts to fight procurement and other types of fraud, waste, and abuse.
In fiscal year 2008 alone, DOD’s hotline received nearly 14,000 contacts  resulting in 2,000 cases referred for investigation. However, because the  FAR rule exempts contractors whose ethics programs include their own  hotlines, and if more contractors opt not to display DOD’s hotline posters,  there is a risk that defense contractor employees will be unaware and not  avail themselves of DOD’s hotline. According to our ethics program  survey, 55 of the 57 contractors report having one or more reporting  mechanisms, such as a hotline for employees to report known or  suspected conduct that violates ethics standards or contract requirements.
The DOD hotline poster’s absence from contractor work sites could also  jeopardize use of whistleblower protections for contractor employees put  in place by DOD in response to legislation separate from the development  of the FAR’s contractor ethics program requirements. Under this  legislation, federal protections were strengthened for contractor  employees against employer reprisals for blowing the whistle to  government entities (such as DOD IG through its fraud hotline) on  suspected gross mismanagement of or illegal activities on a DOD contract.  The contractor internal reporting mechanisms, such as hotline posters  required separately under the new FAR rules, do not provide contractor  employees with the type of whistleblower protections that disclosure to  DOD IG or to other DOD entities offers.
Although DFARS, since January 2009, requires contractors to inform their  employees in writing of these federal whistleblower rights and  protections, without display of DOD’s hotline poster in a contractor work  site, contractor employees could unwittingly disclose information to the  company’s internal hotline, where they would not have federal protections  in the event of employer reprisals. To facilitate contractor employee  whistleblower protections, senior DOD IG headquarters officials  responsible for investigations and policy agreed that it might be necessary  to modify DOD hotline posters for display at contractor work sites to  inform contractor employees that their federal whistleblower protections  are limited to disclosures to government entities only.
According to FAR Council responses to public comments received while  finalizing the hotline display rule, it is the responsibility of the agency  inspector general to determine the need for, and the contents of, the fraud  hotline poster. Given the magnitude of DOD’s contract dollars spent each  year, with tens of thousands of contractors and ongoing efforts by DOD  through its Panel on Contracting Integrity to reduce vulnerabilities to  procurement fraud, we asked DOD IG, DCAA, suspension and debarment,  and AT&L contractor oversight officials for their views. Specifically, we  asked about the risk of defense contractors not displaying DOD hotline  posters and whether the hotline poster’s absence in workplaces where  DOD contracts are performed might impinge on DOD’s ability to timely  address contractor violations. Several of the DOD oversight officials were  not aware of the FAR’s exemption regarding display of the DOD hotline  posters until we told them.
Once informed, some of these DOD officials expressed concern that the  hotline poster’s absence was not in the best interest of reducing DOD’s  vulnerability to procurement fraud. DOD IG officials agreed that changing  DFARS to require all defense contractors to display the DOD hotline  poster should occur. Nearly all of the 57 contractors we surveyed appear  positioned to detect problems because they report having mechanisms  such as hotlines for employees to report problems. However, the DOD IG  team leader for military reprisal investigations expressed concern that  contractor employees may be uncomfortable reporting to their companies’  internal hotlines, an indication that relying only on contractor reporting  mechanisms could also result in DOD not finding out about the problems  at all. Moreover, relying on contractor mechanisms could also delay DOD’s  awareness of such problems and its efforts to verify and act on suspected  violations. For example, under the new FAR rules, the length of time it  takes a contractor to determine if there is credible evidence of a violation  subject to mandatory disclosure requirements could affect DOD’s  awareness of a problem. With the DOD hotline, DOD has immediate  awareness of potential violations from contractor employee calls. While  there might be practical reasons for continuing to exempt some defense  contractors with their own hotlines from displaying DOD’s hotline poster,  such as avoiding the confusion or duplication that could occur with too  many hotline posters on display in one place, senior contract policy  officials in the Office of the Under Secretary of Defense for AT&L believe  that further study is warranted of possible changes in DFARS to more fully  protect defense contracting integrity.
section_title: Conclusions
paragraphs: The FAR requirements provide new direction for defense contractor ethics  programs and present DOD opportunities to improve its oversight of these  programs. The new rules seek to promote organizational cultures that  encourage ethical behavior as well as promote compliance with the law.  Our survey completed in 2009 shows that nearly all of the 57 major  defense contractors reviewed included many of the ethics program  practices before the FAR rules were finalized consistent with the  standards later required for compliance. DOD, in turn, is making positive  changes to address some of the new FAR requirements.
However, additional opportunities exist to improve DOD’s oversight in  two key areas. The first is in the area of verifying the existence of  contractor ethics programs after contract award as part of contracting  officers’ contract administration responsibility. The need for new  oversight attention and guidance across DOD in the area of contract  administration has not been clearly identified or determined. Such  additional oversight of contractor ethics programs during contract  administration could help ensure that contractor ethics programs are in  place as intended.
The second is in the area of DOD’s hotline program, for improved  oversight for potential contract-related fraud, waste, and abuse. The new  FAR contractor ethics rules have the potential to make the hotline  program less effective by ultimately reducing contractor exposure to DOD  hotline posters and diminishing the means by which fraud, waste, and  abuse can be reported under the protection of federal whistleblower laws.  Nearly all of the major contractors surveyed have in-house ethics and  compliance programs that exempt them from displaying the DOD posters.  It is conceivable that virtually no major contractor would be required to  display the DOD hotline posters. Contractor employees might be reluctant  to report violations to an in-house hotline that did not provide federal  protection against company retaliation. However, employees do have such  protection when reporting directly to the DOD hotline.
section_title: Recommendations for Executive Action
paragraphs: We are recommending four actions aimed at improving DOD’s oversight of  defense contractors’ ethics programs.  First, to strengthen oversight during  contract administration, we recommend that the Secretary of Defense  direct the Under Secretary of Defense for AT&L to determine what if any  new DFARS or other guidance is needed to clarify functional  responsibilities of DCMA and other contracting officials during contract  administration for verifying the implementation of contractor ethics  programs as required under the FAR ethics rules.
To avoid delaying or lessening DOD IG awareness of contract-related  problems and diminishing of whistleblower protections for contractor  employees, we recommend that the Inspector General for the Department  of Defense, in accordance with the FAR, take the following two actions:    Determine the need for defense contractors’ display of DOD IG’s fraud  hotline poster, including directing a contractor to display the DOD IG  hotline poster in common work areas for performance of DOD contracts.
Determine the contents of the DOD IG’s fraud hotline poster for display by  defense contractors, including revising the poster to inform contractor  employees of their federal whistleblower protections.
Fourth, if the need for hotline poster display is determined by the  Inspector General, we recommend that the Secretary of Defense direct the  Under Secretary of Defense for AT&L to propose revisions to DFARS to  include policy requiring a contract clause directing a contractor to display  the DOD IG hotline poster in common work areas for performance of DOD  contracts. DFARS policy should require a defense contractor’s display of  the DOD IG fraud hotline poster irrespective of whether that contractor  has its own internal mechanism, such as a hotline for employees to report  contract-related improprieties.
section_title: Agency Comments
paragraphs: We provided a draft of this report and the e-supplement that accompanies  it to DOD for comment. The Office of the Under Secretary of Defense for  AT&L’s Director, Defense Procurement and Acquisition Policy, wrote that  DOD concurs with the first three recommendations. For example,  according to the Director, the first recommendation will be referred to the  Defense Acquisition Regulation (DAR) Council to establish a DFARS case  to determine whether additional guidance is needed to clarify the  administrative contracting officer’s functional responsibilities.
Regarding the last recommendation, the Director wrote that DOD partially  concurs because it is not necessary (as we recommended) for the Panel on  Contracting Integrity to propose the revisions. However, in response to  this recommendation, the Director will submit the proposed revisions to  DFARS via memorandum to the DAR Council. Since DOD’s comment  concurs with the substance of the recommendation, we revised it to better  align with DOD’s preferred method for implementation. DOD’s comments  are reprinted in appendix II.
We are sending copies of this report to the Secretary of Defense, the DOD  Inspector General, the Director of the Office of Management and Budget,  the major defense contractors identified in this report, and other  interested parties. The report also is available at no charge on the GAO  Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-4841 or needhamjk1@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made major contributions to this report  are listed in appendix IV.
section_title: Appendix I: Scope and Methodology
paragraphs: Congress included a provision in the National Defense Authorization Act  for Fiscal Year 2008 requiring us to report on the internal ethics programs  of major defense contractors. In January 2009, we briefed the Senate and  House Armed Services Committees on the preliminary results regarding  the reporting requirements specified in the act. After this congressional  mandate, revisions to the Federal Acquisition Regulation (FAR) to require  internal ethics programs of contractors were finalized. As shown in table  10’s side-by-side comparison, ethics program elements identified by  Congress for inclusion in this report are very similar to the contractor  ethics program elements now required by the FAR.
Given the similarity between some of the ethics program elements in our  congressional mandate and the current FAR requirements, our audit and  reporting objectives were to (1) describe the extent to which contractors  had ethics programs before the finalization of the FAR rules that included  practices consistent with standards now required by the FAR and   (2) assess the impact the new FAR rules have on DOD oversight of  contractor ethics programs.
Section 848 defined a major defense contractor as any company awarded  contracts by DOD during fiscal year 2006 in amounts totaling more than  $500 million. To identify those contractors, we analyzed data on the values  of contracts awarded to all companies from DOD’s Statistical Information  Analysis Division. We initially identified 65 contractors, but we eliminated  six companies that merged or were joint ventures, as well as two foreign  government entities from our review. Based on our review of DOD’s data,  we found that the data were sufficiently reliable for the purpose of  identifying which contractors to include in this report. As a result, we  identified the 57 contractors meeting the major defense contractor criteria  to include in our review. As shown in table 11, which ranks the 57 major  defense contractors by the value of their fiscal year 2006 DOD contract  awards, these companies accounted for more than half of DOD’s total  contract awards in 2006—$164.5 billion of the total $295 billion.
We conducted this performance audit from May 2008 through August 2009  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
The scope and methods we used to perform this audit are described in  greater detail in the remainder of this appendix.
subsections: section_title: First Audit Objective
paragraphs: To determine the extent to which 57 major defense contractors included in  our review have internal ethics programs that include certain practices  consistent with standards now required by the FAR, we designed and  conducted a Web-based survey of all 57 contractors. To gain an initial  understanding of the variety and scope of information reasonably available  on the range of practices used in relation to internal ethics programs, we  reviewed chapter 8 (Sentencing of Organizations) of the 2007 Federal  Sentencing Guidelines Manual and government contract management  publications for information to describe the FAR contractor ethics  program requirements. We also interviewed officials from government and  public entities with knowledge in this area, including the Defense Industry  Initiative on Business Ethics and Conduct, the Ethics Resource Center,  DOD, and the Department of Justice’s National Procurement Fraud Task  Force.
To conduct this survey, we pretested it in July 2008 with Lockheed Martin  Corporation, Electronic Data Systems Corporation, Agility Logistics, and  Mitre Corporation to determine if the questions were clear and unbiased, if  the terminology used to describe the programs was precise, and whether  the survey questionnaire placed an undue response burden on companies.  After revising the survey to incorporate pretest comments in August 2008,  we sent an e-mail to all 57 contractors in early September 2008 with  instructions for accessing the survey and followed up with  nonrespondents by e-mail and telephone to encourage their responses.  After we closed out the survey on October 24, 2008, congressional  committee staff requested that we pursue responses from the remaining  unresponsive contractors, and we contacted the contractors; reopened the  survey on March 13, 2009, for 5 business days; and obtained their  responses.
The multisection survey was designed to address all of the ethics program  elements identified in Section 848 and those now required by the FAR, as  shown in table 10’s side-by-side comparison. The survey was organized in  various sections to obtain contractors’ self-reported information on their  internal ethics programs in key areas, such as (1) code of business ethics  and conduct, (2) internal and external mechanisms for reporting  misconduct, (3) notification to contractor employees of their right to be  free from reprisal for disclosing a substantial violation of law, (4) ethics  training programs, (5) internal audits, and (6) appropriate management  oversight. GAO’s e-supplement, GAO-09-646SP, provides the questions  used for the survey as well as the aggregated responses. We analyzed  responses from the 57 contractors that responded to the survey—a survey  response rate of 100 percent—in comparison to the FAR requirements  introduced from December 2007 through December 2008. In addition to  analyzing self-reported information from the survey responses, we  requested that all 57 contractors send us corroborating documentation to  review for various practices in their internal ethics programs, including  practices now required by the FAR, such as management oversight and  ethics and compliance training. We did not verify implementation or test  the effectiveness of contractor ethics program practices self-reported  through our survey.
We selected a nongeneralizable sample of 4 of the 57 contractors for site  visits in order to review in detail implementation practices for some of the  ethics program policies or procedures described in their survey responses,  such as disciplinary actions, hotline calls, and ethics training programs.  Our selection criteria in part were whether (1) the contractors were  ranked among the top 15 contractors in terms of dollar value of DOD  contracts awarded to them in fiscal year 2006 and (2) their survey  responses indicated that the contractors had such policies or procedures  in use. We visited Boeing Company, General Dynamics, Computer  Sciences Corporation (CSC), and Science Applications International  Corporation (SAIC) from December 2008 through February 2009 and  obtained detailed information from senior company officials responsible  for management of ethics program–related practices described in their  responses to our survey.
To determine the benefits and challenges contractors face in implementing  the new FAR requirements, we analyzed contractor views from our Web- based survey. To identify views and perspectives similar to or different  from those obtained from the survey, we reviewed responses to public  comments prepared by the FAR Council and published in the Federal  Register.
section_title: Second Audit Objective
paragraphs: To assess the impact that expanded FAR contractor ethics program  requirements have on DOD monitoring or approval of defense contractor  ethics programs, we focused on defense and military organizations  responsible for oversight and investigation of contractor operations and  improper business practices: (1) Defense Contract Management Agency  (DCMA); (2) Defense Contract Audit Agency (DCAA); (3) DOD IG; (4) the  Air Force, Army, and Navy offices responsible for suspension and  debarment; and (5) the Office of the Under Secretary of Defense for  Acquisition, Technology and Logistics (AT&L). We interviewed senior  procurement officials; general counsel; and contract administration, audit,  and investigative service officials concerning these agencies’ roles and  responsibilities for monitoring or approving contractor ethics programs.  Through interviews and information obtained from these officials, we  obtained views and reviewed supporting documentation concerning the  impact the new FAR rules have had or could have on DOD contractor  oversight activities regarding monitoring contractors’ compliance with  ethics program practices required by the FAR rules.
In addition, we communicated with selected officials from the DOD  agencies listed above to obtain updates regarding changes in their policies  and procedures to implement the expanded FAR requirements, reviewed  available guidance and instructions these agencies developed to  implement the FAR changes, and analyzed public comments attributed to  DOD or other government sources and FAR Council responses published  in the Federal Register relevant to agencies’ implementation of the  requirements. We also interviewed senior DCAA and DCMA officials  colocated at four contractor field office locations to discuss their oversight  of contractor ethics programs and any concerns they might have related to  those programs on contractor performance and costs. We did not test  DOD agencies’ effectiveness in implementing their contractor ethics  program oversight activities.
section_title: Appendix II: Comments from the Department of Defense
section_title: Appendix III: Required Federal Acquisition Regulation Components for Contractor Ethics Programs
paragraphs: The final FAR rule—effective in December 2008—reflects contractor  ethics program standards across four broad components, as shown in  table 12. According to the FAR Council, the rule establishes a framework  for institutional ethics management and disclosure but does not prescribe  specific ethical requirements. Contractors are free to establish the  appropriate ethical standards for their businesses.
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acquisition and Sourcing Management
section_title: Applied Research and Methods
section_title: General Counsel