Before the FAR changes in December 2007, DFARS provided that contractors must conduct themselves with the highest degree of integrity and honesty. Specifically, defense regulations provided that contractors should have (1) a written code of ethical conduct; (2) ethics training for all employees; (3) periodic reviews of compliance with their code of ethical conduct; (4) internal audits, external audits, or both; (5) disciplinary action for improper conduct; (6) timely reporting to appropriate government officials of any suspected violation of law regarding government contracts; and (7) full cooperation with any government agencies responsible for either investigation or corrective action. While defense regulations provided that contractors should have such elements, they were not mandatory. As a result, under DFARS and until the FAR rules established mandatory ethics program requirements, DOD relied on contractor self-governance—through which a company decided if and how to implement and enforce ethical conduct. Oversight and management of DOD contracting activities is shared among various organizations. Collectively, these organizations help detect instances of fraud, waste, and abuse; try to prevent them from happening; or are involved in correcting policies and procedures when they occur. For example, the Office of the Under Secretary of Defense for AT&L provides policy, guidance, and oversight to acquisition functions. Other DOD organizations may examine contractors’ ethics programs under a range of authorities for contract administration and audit services. Table 1 shows DOD organizations involved in overseeing and managing contracting activities and their primary responsibilities in examining contractors’ ethics programs. A number of cases involving fraud in wartime contracting in Iraq, Kuwait, and Afghanistan and recent scandals involving high-profile defense contractors have prompted significant changes in procurement fraud investigations, enforcement initiatives, legislation, and regulation. By 2007, in view of the trend, the FAR Council commented that the DFARS provision that contractors should have specific elements of an ethics program was no longer considered strong enough to increase contractor compliance with ethical rules of conduct. To address this problem, the FAR Council changed the regulations. After conducting an extensive proposed rulemaking and public comment process from February 2007 through November 2008, the FAR Council twice amended the FAR to impose new ethics requirements on government contractors. The initial rule—effective in December 2007— created a new FAR subpart that requires government contractors to have written codes of business ethics and ethics compliance training programs for contractor employees and to post “fraud hotline” posters at contractor work sites to encourage contractor employees to report fraudulent activity in connection with performance and award of government contracts. However, in December 2008 certain shortcomings in the initial contractor ethics rules were addressed in further amendments to the FAR. For example, public concerns over the first rule’s exemption connected to overseas contracting prompted elimination of this exemption in the second rule, and as of December 2008, overseas and commercial contractors are now required to maintain written codes of business ethics and conduct. In addition, the amended FAR contractor ethics rules now require contractors to disclose violations of criminal law involving fraud, conflict of interest, bribery, or gratuity violations or violations of the civil False Claims Act (31 U.S.C. 3729-3733) in connection with award or performance of government contracts and subcontracts. It should be noted that these requirements are implemented by contract clause and are mandatory. The amended rules also specifically subject contractors to suspension and debarment from government contracting for knowingly failing to disclose such violations and failing to disclose receipt of overpayments on government contracts in a timely manner. The FAR changes effective in December 2008 also enhance provisions for sound ethics business practices by specifically requiring the establishment of internal control systems for facilitating discovery of improper conduct, ensuring that corrective measures are promptly carried out, and otherwise promoting an organizational culture that encourages ethical conduct and a commitment to compliance with the law. In publishing the December 2008 rule’s amplified requirements, the FAR Council stated that the U.S. Sentencing Commission’s federal sentencing guidelines are the source of the FAR text, which provides guidance for contractors consistent with the guidelines on effective compliance and ethics programs for organizations. Among other things, the sentencing guidelines state that an ethics and compliance program should be reasonably designed, implemented, and enforced so that it is generally effective in preventing and detecting criminal conduct. Notably, the sentencing guidelines also state that the failure to prevent or detect a particular offense does not necessarily mean that the program is generally ineffective in preventing and detecting criminal conduct. According to the FAR Council, the final rule reflects standards across four broad components and establishes a framework for institutional ethics management and disclosure, but does not prescribe specific ethical requirements. Contractors are free to establish the appropriate ethical standards for their businesses. For a more detailed description of the final rule’s establishment of standards across four broad components, see appendix II. In September 2008 and before the FAR rules were finalized, to identify contractor ethics program practices, we surveyed all 57 contractors to obtain information on the extent to which their programs included practices required or proposed in the FAR or otherwise addressed in congressional requirements for this report. As summarized in table 2, nearly all of the 57 contractors responding to our survey report using many of the ethics practices consistent with standards now required by the FAR. The ethics program practices information we obtained was not designed to test contractor compliance with the rules that came later. Views of contractors surveyed were mixed with regard to the benefits and challenges they face in implementing the FAR contractor ethics rules. Contractors responding to our survey cited several expected benefits and challenges of the new ethics rules. Other benefits and challenges were attributed by the FAR Council to public comments from contractor industry and other sources when finalizing the new FAR contractor ethics rules in 2008. Some of these benefits and challenges are highlighted in table 3. With regard to the new FAR rule’s mandatory timely disclosure of certain contract-related violations of criminal law or the False Claims Act, several contractors responding to our survey as well as industry concerns cited in public comments indicated that contractors would face significant difficulty in implementing those requirements. In response to these concerns, the FAR Council revised key aspects of the final rule regarding timely disclosure, including to more closely focus the situations that must be disclosed by limiting violations of criminal law to certain violations involving fraud, conflict of interest, bribery, or gratuity violations that have occurred in connection with the award, performance, or closeout of a contract or subcontract; make “credible evidence” the standard for when timely disclosure should add clarification that if a violation relates to more than one government contract, the contractor may make the disclosure to the agency officials responsible for the largest dollar value contract affected by the violation; and limit the application of suspension or debarment to undisclosed overpayment cases in which the amount is significant. Highlighted below is some of the aggregated analysis resulting from the survey about contractors’ ethics practices. A more complete tabulation of survey questions together with tables indicating the levels of response can be found in the e-supplement to this report, found on our Web site at http://redesign-www.gao.gov/special.pubs/gao-09-646sp/index.html. One purpose of a code of conduct can be to communicate a company’s statement of ethical values and integrity as established by top leadership. Although the FAR does not specify what topics a contractor must include in its code of conduct, they can cover a broad range of business ethics and conduct standards, such as conflict of interest, relationships with vendors, and compliance with government contracting requirements for procurement integrity, classified information, and recruiting and employing current or former government personnel, according to sources on government contractor ethics practices. As shown in table 4, nearly all of the contractors reported using such practices. One purpose of ongoing contractor ethics awareness and compliance programs can be to promote conformance with the code of business ethics and requirements. Such programs should include reasonable steps to communicate periodically to employees about the contractor’s ethics standards and procedures via training programs and communicating information on individuals’ roles and responsibilities under the ethics program. As shown in table 5, nearly all of the contractors reported including steps such as requiring ethics training and periodically communicating ethics-related information to employees working on DOD contracts. All 41 contractors that reported having overseas contract operations indicated that they had incorporated their ethics awareness and compliance programs overseas. However 26 contractors reported experiencing challenges implementing ethics programs overseas, including differences in legal and regulatory environments relating to, for example, employee privacy, cultural and language barriers, and technical or hostile conditions impeding computer-based training. Having contractors implement internal control systems increases the likelihood that their ethics and compliance programs are generally effective in preventing, detecting, and addressing contract-related fraud, waste, and abuse. Nearly all of the contractors in our survey reported using internal control practices consistent with the FAR’s standards. High-level of management oversight. By assigning responsibility at a sufficiently high level and providing adequate staffing to ensure the effectiveness of the ethics program, a contractor can demonstrate true interest and involvement of management. As shown in table 6, most contractors report formally assigning responsibility and staff resources to an office or individual and several have their ethics managers report on a regular basis to top management. Site visits with four contractors showed that all had ongoing and active high-level management oversight of their ethics programs. Periodic reviews and audits. An internal control system should be reviewed regularly from a compliance perspective through periodic risk assessments and audits. Most of the contractors reported a range of practices for periodic reviews and audits, as shown in table 7. In the case of our four site visits, we confirmed that all four contractors had internal audits or reviews of their ethics program as recently as 2008. Examples of risk areas addressed by these contractors’ internal ethics program audits include procurement integrity, foreign corrupt practices, and compliance with the code of conduct and policy for employee background checks. Internal mechanism for reporting misconduct.