Mandatory Disclosure Requirements & Related Compliance Programs: The Current Environment

2. Mandatory Disclosure Requirements & Related Compliance Programs: The Current Environment Breakout Session # 106 Anthony Kim & Kristin Torcasi July 19, 2010 Session Schedule: 11:15 – 12:30 1

3. Course Agenda Summary / Applicability of Rule Requirements of Rule Contractor Compliance FAR Councils Perspective Final Thoughts

4. Today's Internal Control Environment at a Glance 2007: Requirement for ethics programand system of internal controls July 2008 GAO report - Allegations That Certain Audits at Three Locations Did Not Meet Professional Standards Were Substantiated Dec 2008 DCAA Policy Revisions ICS audit opinions/Denial of Access March 2008: DCAA re-defines materiality DCAA revises ICAPS approach Dec 2008 “Close the Fraud Loophole” final ethics, compliance, internal controlsand disclosure rule Jan 2010 DFARS proposed rule on business systems

5. Summary of Mandatory Disclosure Rule Final Rule Effective December 12, 2008 Amends FAR 3.10, 9.4, 52.203-13 to require: Ongoing business ethics and compliance program and internal control system within 90 days of contract award (not required for small business or commercial item contracts) Mandatory disclosure if principal has credible evidence of: Criminal law violations involving fraud, conflict of interest, bribery, or gratuity violations Civil False Claims Act violations Significant overpayments Suspension or debarment for knowing failure to timely disclose

6. Applicability of Mandatory Disclosure Rule Applies to all contracts over $5M and >120 days Applies in the U.S. and overseas Must be flowed down to subcontracts that meet the same size and duration thresholds All contractors must: Have a written code of business ethics and conduct (30 days after award); Make the code available to all employees involved in performance of the contract; Exercise due diligence to prevent and detect improper conduct; Promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law

7. Requirements – Code of Business Ethics & Conduct Contractors shall have a written code of business ethics and conduct within 30 days of contract award This should be made available to all employees engaged in contract performance Contractors shall exercise due diligence to prevent and detect criminal conduct and promote an organizational culture that encourages ethical conduct Contractors shall timely disclose, in writing, to the agency OIG and CO whenever the contractor has credible evidence of a criminal violation, a civil False Claims violation or overpayment FAR Subpart 3.10; FAR 52.203-13

8. Requirements – Timely Disclosure No set time frame defines “timely” “Timely” requirement should be read in the context of the “credible evidence” standard, which provides for a period of internal investigation to determine whether evidence is credible before it is disclosed Contractor should take reasonable steps to determine evidence is credible, not launch a complex investigation No time frame for what constitutes a “reasonable investigation” Measured from contract award or discovery of credible evidence, whichever is later Disclosure requirements under the clause apply prospectively from 12.12.08; however, past conduct on contracts open to exposure is still required

9. Requirements – Ethics Awareness & Compliance Program Establish an ongoing business ethics awareness and compliance program within 90 days of contract award Not applicable to small businesses or acquisition of commercial items Key Elements: Include reasonable steps to communicate periodically and in a practical manner the Contractor's standards and procedures and other aspects of the Contractor's business ethics awareness and compliance program and internal control system Deliver effective training programs and otherwise disseminating information appropriate to an individual's respective roles and responsibilities The training conducted under this program shall be provided to the Contractor's principals and employees, and as appropriate, the Contractor's agents and subcontractors

10. Requirements – Internal Control System Establish an internal control system within 90 days of contract award (Not applicable to small businesses or acquisition of commercial items) The internal control system will establish policies and procedures to facilitate timely discovery of improper conduct and ensure corrective measures are carried out At a minimum, the internal control system will provide for: Responsibility at a high level with adequate resources Reasonable effort not to include a principal who has engaged in conduct conflicting with the code of business ethics and conduct Periodic reviews of company business practices, policies, procedures and internal controls for compliance with the code and with Government contract requirements Full cooperation with any Government agency responsible for audits, investigations, or corrective actions

11. Requirements – Consequences of Noncompliance FAR 9.406-2(b)(1)(vi) states that a contractor can be debarred for knowing failure by a principal to timely disclose to the Government credible evidence of: A violation of Federal criminal law A violation of the civil False Claims Act Significant overpayment on the contract

12. “Definition” of Certain Elements “Principal” means an officer, director, owner, partner or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager; head of a subsidiary, division, or business segment; and similar positions). (FAR 2.101) FAR Councils state that this definition should be interpreted broadly and could include compliance officers or directors of internal audit, as well as other positions of responsibility “Knowing Failure” – the principal must have actual knowledge of the violation or overpayment “Significant Overpayment” – no definition of significant; however, per FAR Councils, significant implies more than just dollar value, including and depending upon the circumstances as well as the amount of the overpayment

13. Contractor Compliance – Contracts Affected by Rule Direct reporting requirement applicable to all covered contracts (those that include the FAR clause) and encompassing violations in connection with those covered contracts FAR 52.203-13(b)(3) Reporting requirement under the formal internal control system applicable to all covered contracts (other than those with small businesses and commercial items) and encompassing violations in connection with ANY government contract FAR 52.203-13(c)(2)(ii)(F) Reporting requirement under the debarment and suspension provisions applicable to ALL contractors and encompassing violations in connection with ANY government contract FAR Subpart 9.4

14. Contractor Compliance – What to Disclose Information sufficient for to identify the nature and extent of the offense and the individuals responsible for the conduct A description of the overpayment, including the circumstances of the overpayment, affected contract number, affected line item and contractor point of contact

15. Contractor Compliance – Meeting the Rules Understand what contracts are subject to mandatory disclosure, including contracts closed within the last 3 years Identify who is a “principal” on the contract Consider having principals identify information regarding potential violations or overpayments under contracts subject to mandatory disclosure Ensure that subcontracts appropriately flowdown mandatory reporting requirements Review existing compliance programs to make sure they are current and effective Establish a testing / monitoring program Effectively communicate and train Define disclosure process

16. FAR Councils Perspective:How Big of a Change? The government recognized that the move to a mandatory disclosure program reflects a “sea change” and is a “major departure” from voluntary disclosure FAR Councils state that mandatory disclosure is necessary because “the policy of voluntary disclosure has been largely ignored by contractors for the past 10 years” Federal Register Vol. 73, No. 219

17. FAR Councils Perspective:Retroactive Application In response to concerns related to internal control systems and suspension/debarment that the rule states reportable violations could occur in relation to ANY government contract, the FAR Councils: Clarified that the disclosure requirement is limited to contracts awarded to the contractor, not violations of other contractors under contracts unrelated to their own Do not agree with the respondents who think that disclosure under the internal control system or as a potential cause for suspension/debarment should only apply to conduct occurring after the date the rule is effective or the clause is included in the contract, or the internal control system is established. The laws against these violations were already in place before the rule became effective or any of these other occurrences Federal Register Vol. 73, No. 219

18. FAR Councils Perspective:Prosecution and Debarment Risk of Prosecution Existing DOJ guidelines that address corporate prosecution standards, while certainly not providing amnesty, suggest that if a company discloses such violations, the prosecution will be of the individuals responsible for the violation, not the entire organization Risk of Debarment It is unlikely that any contractor would be suspended or debarred absent the determination that a violation had actually occurred. Present responsibility is the ultimate basis of suspension or debarment Federal Register Vol. 73, No. 219

19. Final Thoughts The significant compliance obligations imposed by the mandatory disclosure rule makes it even more important for contractors to be ever vigilant in ensuring they promptly, carefully and thoroughly review all reports or indications of misconduct Contractors should carefully document non-disclosure decisions to evidence the reported conduct was of no potential significance At the time of disclosure, contractors will need to consider their position with respect to possible suspension and debarment issues Contractors must reassess the effectiveness of their compliance programs and take immediate steps to ensure compliance

20. The End Comments / Questions

21. About Baker Tilly Founded in 1931 as a certified public accounting firm Currently operate in six states with over 1,400 professionals Member of Baker Tilly International, the world’s 8th largest network of accounting firms Headquartered in Chicago East Region is located in Washington, D.C. with over 275 professionals East Region provides a range of professional services including: Financial statement audit Tax planning and compliance Consulting services to private and publicly traded companies across many industries Government contract and grant consulting Forensic and litigation services Mergers and acquisitions Technology management

22. Presenters Anthony Kim, Senior Manager Anthony has over 10 years of experience in various cost accounting and compliance issues related to government contracts.  Specifically, he is knowledgeable in the areas of government contract procurement regulations, Cost Accounting Standards, OMB Circulars, Sarbanes-Oxley Section 404, Generally Accepted Government Auditing Standards, Generally Accepted Auditing Standards and Generally Accepted Accounting Principles. Anthony earned his Bachelor of Science in Accounting from George Mason University. He is a member of the National Contract Management Association and Institute of Management Accountants. Prior to Baker Tilly, Anthony held positions working as a manager for a big four accounting firm and an associate director for a major consulting firm. Anthony is a member of the Baker Tilly Government Contractor Advisory Services practice in Vienna, Virginia. Tel: (703) 923-8351, anthony.kim@bakertilly.com

23. Presenters Kristin Torcasi, Manager Kristin has over 7 years of experience in government contract accounting, pricing, business system and internal control oversight, and regulatory and federal contract compliance assisting defense, manufacturing, engineering, information and communications, higher education, and non-profit clients. Kristin earned her Bachelor of Science in Accounting and Business Management from Elon University. She is a member of the American Institute of Certified Public Accountants, Greater Washington Society of Certified Public Accountants, and National Contract Management Association. Prior to Baker Tilly, Kristin worked for DCAA, KPMG, and Navigant Consulting. Kristin is a member of the Baker Tilly Government Contractor Advisory Services practice in Vienna, Virginia. Tel: (703) 923-8376, kristin.torcasi@bakertilly.com