This is the accessible text file for GAO report number GAO-09-591 
entitled 'Defense Contracting Integrity: Opportunities Exist to Improve 
DOD's Oversight of Contractor Ethics Programs' which was released on 
September 22, 2009. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Committees: 

United States Government Accountability Office: 
GAO: 

September 2009: 

Defense Contracting Integrity: 

Opportunities Exist to Improve DOD's Oversight of Contractor Ethics 
Programs: 

GAO-09-591: 

GAO Highlights: 

Highlights of GAO-09-591, a report to congressional committees. 

Why GAO Did This Study: 

Until recently, ethics programs and practices of defense contractors 
were self-policed. Given the significant sums spent to acquire goods 
and services, the Federal Acquisition Regulation (FAR) was amended 
twice starting in December 2007 to first mandate and later amplify 
contractor ethics program rules. Before FAR changes were finalized in 
December 2008, Congress required GAO to report in 2009 on the ethics 
programs of major defense contractors. This report (1) describes the 
extent that contractors had ethics programs before the finalization of 
the FAR rules that included practices consistent with standards now 
required by the FAR and (2) assesses the impact the new FAR rules have 
on Department of Defense (DOD) oversight of contractor ethics programs. 
To do this work, in September 2008 GAO surveyed all 57 contractors—
those receiving more than $500 million in 2006 DOD contract awards—and 
interviewed DOD contractor oversight agency officials on the impact of 
the new FAR rules on oversight. 

What GAO Found: 

All 57 contractors responded to GAO’s survey, and 55 reported having 
ethics programs that include many of the practices consistent with 
standards now required for compliance with the FAR. The ethics 
practices information GAO obtained was from before the FAR rules were 
finalized and thus was not designed to test contractor compliance with 
the rules that came later. 
 
Table: Contractor Responses on Ethics Practices Now Required by the 
FAR: 

FAR standard: Code of business ethics and conduct; 
Contractors reporting these practices: 
* 55 have written codes; 
* 54 provide copies to employees. 

  
FAR standard: Ethics awareness and compliance program; 
Contractors reporting these practices: 
* 55 have ongoing programs; 
* 51 require ethics training for employees and managers working on DOD 
contracts; 
* 55 use other mechanisms to communicate employee ethics awareness and 
compliance. 

FAR standard: Internal control system: High level of management 
oversight; Contractors reporting these practices: 
* 52 have an office or individual charged with implementing the ethics 
program
* 25 report quarterly top management oversight of ethics program 
managers 

FAR standard: Internal control system: Periodic reviews, audits, or 
both; 
Contractors reporting these practices: 
* 52 have internal reviews or audits to test ethics program; 
* 47 periodically assess risks of improper or criminal conduct; 
Internal control system: Mechanisms for reporting misconduct; 
* 55 have internal reporting mechanisms, such as hotlines; 
* 54 have a policy for employees to report anonymously or 
confidentially. 

FAR standard: Internal control system: Disciplinary systems; 
Contractors reporting these practices: 
* 52 have codes that provide examples of disciplinary consequences, 
such as counseling and termination. 

FAR standard: Timely disclosure: 
Contractors reporting these practices: 
* Before FAR rule, 34 had a formal policy for voluntary disclosure to 
DOD of contract-related violations
* After FAR rule, 4 contractors GAO visited changed disclosure policy 
to comply with new mandatory disclosure requirement. 

Source: GAO analysis of contractor survey. 

[End of table] 

In response to the new FAR rules, DOD has made two key oversight 
improvements by revising its contract audit guidance to cover the new 
ethics requirements and establishing the Contractor Disclosure Program 
to implement the mandatory disclosure requirement. However, 
opportunities exist to improve DOD’s oversight in two other key areas. 
For example, in verifying implementation of contractor ethics programs 
during contract administration, the impact of the FAR rules on 
oversight at this point is negligible. GAO found that DOD had no plans 
to change contract administration offices’ oversight because authority 
for oversight is not explicit nor is organizational responsibility 
clear. Also, with regard to contractors’ hotline poster displays, the 
new FAR rules could reduce DOD’s awareness of potential violations. The 
rules exempt contractors with ethics programs that include their own 
hotlines from the requirement to display DOD hotline posters. If 
contractor employees report violations to company hotlines instead of 
DOD hotlines, the employees do not receive the same protections from 
whistleblower laws. Whistleblower protections for employees unaware of 
the DOD hotline could be jeopardized. 

What GAO Recommends: 

GAO recommends four actions aimed at improving oversight of ethics 
programs during contract administration and DOD hotline poster 
requirements for contractors to ensure that whistleblower protections 
are communicated. DOD concurs with GAO’s recommendations. 

View [hyperlink, http://www.gao.gov/products/GAO-09-591] or key 
components. For more information, contact John Needham at (202) 512-
4841 or needhamjk1@gao.gov. To view the e-supplement online, click 
[hyperlink, http://www.gao.gov/products/GAO-09-646SP]. 

[End of section] 

Contents: 

Letter: 

Background: 

Contractors Report Using a Range of Ethics Program Practices Now 
Required by the FAR: 

New FAR Rules May Improve DOD Oversight of Contractor Ethics Programs 
in Some Areas but Not Others: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments: 

Appendix I: Scope and Methodology: 

Appendix II: Comments from the Department of Defense: 

Appendix III: Required Federal Acquisition Regulation Components for 
Contractor Ethics Programs: 

Appendix IV: GAO Contact and Staff Acknowledgments: 

Tables: 

Table 1: DOD Organizations Responsible for Oversight and Management of 
DOD Contracting Activities in Which Contractor Ethics Programs May Be 
Examined: 

Table 2: Contractor Responses on Ethics Practices Now Required by the 
FAR: 

Table 3: Highlights of GAO Contractor Survey and FAR Public Comments 
regarding Benefits to Contractors and Challenges They Face in 
Implementing FAR Ethics Rules: 

Table 4: Contractor Responses on Practices Now Required by the FAR for 
Code of Business Ethics and Conduct: 

Table 5: Contractor Responses on Business Ethics and Awareness 
Practices for Communicating Information concerning Individual Roles and 
Responsibilities: 

Table 6: Contractor Responses on Assignment of Ethics Program 
Responsibility and High-Level Oversight: 

Table 7: Contractor Responses on Periodic Reviews and Audits: 

Table 8: Contractor Responses on Anonymous/Confidential Reporting of 
Misconduct and Contract-Related Violations: 

Table 9: Contractor Responses on Ethics-Related Disciplinary Action: 

Table 10: Comparison of Ethics Program Elements in Congressional 
Mandate and FAR Requirements: 

Table 11: Contractors Reviewed by GAO, by Value of Total Contract 
Awards from DOD in Fiscal Year 2006: 

Table 12: Required FAR Components for Contractor Ethics Program 
Practices: 

Figure: 

Figure 1: DOD Hotline Posters Available for Contractor Display: 

Abbreviations: 

ACO: administrative contracting officer: 

AT&L: Acquisition, Technology, & Logistics: 

CAM: Defense Contract Audit Agency, Contract Audit Manual: 

CAO: contract administration office: 

DAR: Defense Acquisition Regulation: 

DCAA: Defense Contract Audit Agency: 

DCMA: Defense Contract Management Agency: 

DFARS: Defense Federal Acquisition Regulation Supplement: 

DOD: Department of Defense: 

DOJ: Department of Justice: 

DOD IG: Department of Defense Inspector General: 

FAR: Federal Acquisition Regulation: 

GAO: Government Accountability Office: 

[End of section] 

United States Government Accountability Office: 
Washington, DC 20548: 

September 22, 2009: 

Congressional Committees: 

In fiscal year 2008, the Department of Defense (DOD) spent more than 
$387 billion for goods and services from more than 85,000 contractors. 
Given the magnitude of taxpayer money at stake, it is essential that 
defense contractors conduct their business operations with integrity. 
In the last several years there have been a number of cases of fraud, 
waste, and abuse in wartime contracting and even some high-profile 
criminal and civil convictions of large defense contractors because of 
procurement integrity and foreign corrupt practices violations. These 
procurement fraud cases heightened concerns in Congress and the 
executive branch about the adequacy of defense contractors' ethics 
programs in preventing or addressing misconduct that could put billions 
of dollars of contracted goods and services at risk. 

In the past, DOD's policy under the Defense Federal Acquisition 
Regulation Supplement (DFARS) encouraged contractors to have written 
ethics policies and recommended practices, such as ethics training for 
all employees and hotlines or other internal mechanisms for them to 
report suspected misconduct.[Footnote 1] Essentially, defense 
contractor ethics programs were voluntary and self-policed. Moreover, 
our prior work raised concerns that DOD lacked adequate oversight of 
its contractors' ethics programs, recommending that enhanced knowledge 
of contractor ethics programs would enable DOD to assess whether the 
public trust is protected.[Footnote 2] 

Given the significant sums of federal dollars spent by agencies to 
acquire goods and services, and the need to establish a clear and 
consistent policy regarding contractor code of ethics and business 
conduct, the Federal Acquisition Regulation (FAR) was amended twice to 
address contractor ethics programs. In December 2007 and again in 
December 2008, the FAR was amended first to mandate and then to amplify 
governmentwide ethics program requirements for certain contractors. 
[Footnote 3] Contractors' internal programs must now include an ethics 
and compliance system with several practices aimed at preventing and 
detecting misconduct and at promoting an organizational culture that 
encourages ethical conduct and a commitment to compliance with the law. 
Before FAR changes were finalized in late 2008, Congress included a 
provision in the National Defense Authorization Act for Fiscal Year 
2008 requiring us to report on the internal ethics programs of major 
defense contractors--defined as any company that received more than 
$500 million in DOD contract awards in fiscal year 2006--and the extent 
to which DOD monitors or approves them.[Footnote 4] In January 2009, we 
briefed your committees on the preliminary results regarding the 
reporting requirements specified in the act. Taking into consideration 
the new FAR contractor ethics program rules, which are very similar to 
some of the reporting requirements specified in the act,[Footnote 5] 
this report (1) describes the extent to which contractors had ethics 
programs before the finalization of the FAR rules that included 
practices consistent with standards now required by the FAR and (2) 
assesses the impact the new FAR rules have on DOD oversight of 
contractor ethics programs. 

To select contractors for review, we used DOD's contract award data and 
identified 57 major defense contractors receiving more than $500 
million in fiscal year 2006 for review. To obtain information on 
contractor ethics programs and practices, in September 2008 we surveyed 
all 57 contractors. We also obtained corroborating documentation for 
various practices--including those consistent with the FAR's standards, 
such as management oversight and ethics and compliance training--and 
information about the benefits to contractors and the challenges they 
face in implementing the new FAR ethics rules. We analyzed responses 
from all 57 contractors and reviewed the FAR Council's disposition of 
public comments considered as part of the rulemaking process for 
additional perspectives on benefits to contractors and challenges they 
face implementing new ethics program rules.[Footnote 6] While we 
reviewed the contractors' self-reported practices for consistency with 
the FAR rules that came later, we did not test them for effectiveness 
or compliance. We selected a nongeneralizable sample of four 
contractors for site visits in order to review in detail implementation 
practices for some of the ethics program policies or procedures 
described in their survey responses. We chose these four contractors 
because (1) they ranked among the top 15 contractors in terms of dollar 
value of fiscal year 2006 DOD contract awards and (2) their survey 
responses indicated that they had such policies or procedures in use. 

To assess the impact the new FAR contractor ethics rules have on DOD, 
we focused on defense and military organizations responsible for 
oversight and investigation of contractor operations and improper 
business practices.[Footnote 7] These organizations included the (1) 
Defense Contract Management Agency (DCMA); (2) Defense Contract Audit 
Agency (DCAA); (3) DOD Office of the Inspector General (DOD IG); (4) 
Air Force, Army, and Navy offices responsible for suspension and 
debarment; and (5) Office of the Under Secretary of Defense for 
Acquisition, Technology and Logistics (AT&L). We interviewed senior 
procurement officials; general counsel; and contract administration, 
audit, and investigative service officials concerning these agencies' 
roles and responsibilities for monitoring or approving contractor 
ethics programs. Through interviews and information obtained from these 
officials, we obtained views and reviewed supporting documentation 
concerning the impact the new FAR rules have had or could have on DOD 
contractor oversight activities related to monitoring contractors' 
compliance with ethics program practices required by the new rules. We 
did not test DOD agencies' effectiveness in implementing their 
oversight activities related to monitoring contractor ethics programs. 

We conducted this performance audit from May 2008 through August 2009 
in accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe that 
the evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. Appendix I provides 
additional details on our scope and methodology, including a list of 
the 57 contractors reviewed. 

Background: 

Defense Contractor Ethics Programs and DOD Oversight before New FAR 
Rules: 

Before the FAR changes in December 2007, DFARS provided that 
contractors must conduct themselves with the highest degree of 
integrity and honesty.[Footnote 8] Specifically, defense regulations 
provided that contractors should have (1) a written code of ethical 
conduct; (2) ethics training for all employees; (3) periodic reviews of 
compliance with their code of ethical conduct; (4) internal audits, 
external audits, or both; (5) disciplinary action for improper conduct; 
(6) timely reporting to appropriate government officials of any 
suspected violation of law regarding government contracts; and (7) full 
cooperation with any government agencies responsible for either 
investigation or corrective action.[Footnote 9] While defense 
regulations provided that contractors should have such elements, they 
were not mandatory. As a result, under DFARS and until the FAR rules 
established mandatory ethics program requirements, DOD relied on 
contractor self-governance--through which a company decided if and how 
to implement and enforce ethical conduct. 

Oversight and management of DOD contracting activities is shared among 
various organizations. Collectively, these organizations help detect 
instances of fraud, waste, and abuse; try to prevent them from 
happening; or are involved in correcting policies and procedures when 
they occur.[Footnote 10] For example, the Office of the Under Secretary 
of Defense for AT&L provides policy, guidance, and oversight to 
acquisition functions. Other DOD organizations may examine contractors' 
ethics programs under a range of authorities for contract 
administration and audit services. Table 1 shows DOD organizations 
involved in overseeing and managing contracting activities and their 
primary responsibilities in examining contractors' ethics programs. 

Table 1: DOD Organizations Responsible for Oversight and Management of 
DOD Contracting Activities in Which Contractor Ethics Programs May Be 
Examined: 

Contract audit services and administration: 

DOD organization: DCAA; 
Responsibility: Contract audit services and administration: Located on-
site at contractor facilities for ongoing contract audit purposes, DCAA 
audits internal control systems--including the contractor's control 
environment for integrity and ethical values--every 3 to 4 years, and 
reports on adequacy of controls. According to DCAA, the contractor's 
control environment has a pervasive influence on its business 
activities and is the foundation for all other internal control 
systems, such as billing and labor. DCAA also makes investigation 
referrals, usually to the DOD IG, regarding situations that reasonably 
appear to entail fraud that it encounters during its contract audits. 

DOD organization: DCMA; 
Responsibility: Contract audit services and administration: DCMA is a 
combat support agency responsible for ensuring the integrity of 
contractual processes and provides a broad range of contract and 
procurement management services to DOD buying organizations. As of 
December 2008, DCMA reports managing 291,000 prime contracts valued at 
$950 billion. Also located on-site for ongoing contract administration 
purposes, as needed, DCMA monitors ethics program corrections in 
response to DCAA-identified deficiencies. 

Improper business practices: 

DOD organization: DOD IG; 
Responsibility: Contract audit services and administration: DOD IG 
conducts audits and oversees matters relating to detection and 
prevention of fraud, waste, and abuse, and collaborates with numerous 
other DOD entities, as many activities are involved in addressing these 
issues across DOD. DOD IG does not monitor contractor ethics programs 
per se, but may get insight through oversight of and follow-up on 
irregularities or misconduct reported through DCAA, the Defense Hotline 
Program, and the DOD Contractor Disclosure Program. 

DOD organization: Air Force, Army, and Navy offices of general counsel 
suspension and debarment officials; 
Responsibility: Contract audit services and administration: During any 
administrative suspension or debarment proceeding or in reaching an 
administrative settlement, the contractor's ethics program may come 
under the review and approval of the agency's suspension and debarment 
official. For example, under separate administrative compliance 
agreements from March 2005 through October 2007, the Air Force and Army 
suspension and debarment officials approved changes in and policed 
compliance with ethics programs of two contractors in our study. 

Sources: DOD and FAR (information); GAO (analysis and presentation). 

[End of table] 

Concerns over Procurement Fraud Trends Prompt FAR Contractor Ethics 
Rules: 

A number of cases involving fraud in wartime contracting in Iraq, 
Kuwait, and Afghanistan and recent scandals involving high-profile 
defense contractors have prompted significant changes in procurement 
fraud investigations, enforcement initiatives, legislation, and 
regulation. By 2007, in view of the trend, the FAR Council commented 
that the DFARS provision that contractors should have specific elements 
of an ethics program was no longer considered strong enough to increase 
contractor compliance with ethical rules of conduct.[Footnote 11] 

To address this problem, the FAR Council changed the regulations. After 
conducting an extensive proposed rulemaking and public comment process 
from February 2007 through November 2008, the FAR Council twice amended 
the FAR to impose new ethics requirements on government contractors. 
The initial rule--effective in December 2007--created a new FAR subpart 
that requires government contractors to have written codes of business 
ethics and ethics compliance training programs for contractor employees 
and to post "fraud hotline" posters at contractor work sites to 
encourage contractor employees to report fraudulent activity in 
connection with performance and award of government contracts.[Footnote 
12] 

However, in December 2008 certain shortcomings in the initial 
contractor ethics rules were addressed in further amendments to the 
FAR.[Footnote 13] For example, public concerns over the first rule's 
exemption connected to overseas contracting prompted elimination of 
this exemption in the second rule, and as of December 2008, overseas 
and commercial contractors are now required to maintain written codes 
of business ethics and conduct. In addition, the amended FAR contractor 
ethics rules now require contractors to disclose violations of criminal 
law involving fraud, conflict of interest, bribery, or gratuity 
violations or violations of the civil False Claims Act (31 U.S.C. 3729- 
3733) in connection with award or performance of government contracts 
and subcontracts. It should be noted that these requirements are 
implemented by contract clause and are mandatory.[Footnote 14] The 
amended rules also specifically subject contractors to suspension and 
debarment from government contracting for knowingly failing to disclose 
such violations and failing to disclose receipt of overpayments on 
government contracts in a timely manner. 

The FAR changes effective in December 2008 also enhance provisions for 
sound ethics business practices by specifically requiring the 
establishment of internal control systems for: 

* facilitating discovery of improper conduct, 

* ensuring that corrective measures are promptly carried out, and: 

* otherwise promoting an organizational culture that encourages ethical 
conduct and a commitment to compliance with the law. 

In publishing the December 2008 rule's amplified requirements, the FAR 
Council stated that the U.S. Sentencing Commission's federal sentencing 
guidelines are the source of the FAR text, which provides guidance for 
contractors consistent with the guidelines on effective compliance and 
ethics programs for organizations. Among other things, the sentencing 
guidelines state that an ethics and compliance program should be 
reasonably designed, implemented, and enforced so that it is generally 
effective in preventing and detecting criminal conduct. Notably, the 
sentencing guidelines also state that the failure to prevent or detect 
a particular offense does not necessarily mean that the program is 
generally ineffective in preventing and detecting criminal conduct. 

According to the FAR Council, the final rule reflects standards across 
four broad components and establishes a framework for institutional 
ethics management and disclosure, but does not prescribe specific 
ethical requirements. Contractors are free to establish the appropriate 
ethical standards for their businesses. For a more detailed description 
of the final rule's establishment of standards across four broad 
components, see appendix II. 

Contractors Report Using a Range of Ethics Program Practices Now 
Required by the FAR: 

In September 2008 and before the FAR rules were finalized, to identify 
contractor ethics program practices, we surveyed all 57 contractors to 
obtain information on the extent to which their programs included 
practices required or proposed in the FAR or otherwise addressed in 
congressional requirements for this report. As summarized in table 2, 
nearly all of the 57 contractors responding to our survey report using 
many of the ethics practices consistent with standards now required by 
the FAR. The ethics program practices information we obtained was not 
designed to test contractor compliance with the rules that came later. 

Table 2: Contractor Responses on Ethics Practices Now Required by the 
FAR: 

FAR standard: Code of business ethics and conduct; 
Contractors reporting these practices: 
* 55 have written codes; 
* 54 provide copies to employees. 

FAR standard: Ethics awareness and compliance program; 
Contractors reporting these practices: 
* 55 have ongoing programs; 
* 51 require ethics training for employees working on DOD contracts; 
* 55 use other mechanisms to communicate employee ethics awareness and 
compliance. 

FAR standard: Internal control system; High level of management 
oversight; Contractors reporting these practices: 
* 52 have an office or individual charged with implementing the ethics 
program; 
* 25 report quarterly top management oversight of ethics program 
managers. 

FAR standard: Internal control system; Periodic reviews, audits, or 
both; Contractors reporting these practices: 
* 52 have internal audit functions that review ethics program 
effectiveness; 
* 47 periodically assess risks of improper or criminal conduct. 

FAR standard: Internal control system; Internal mechanism for reporting 
misconduct; Contractors reporting these practices: 
* 55 have internal reporting mechanisms, such as hotlines; 
* 54 have a policy for employees to report misconduct anonymously or 
confidentially. 

FAR standard: Internal control system; Disciplinary systems; 
Contractors reporting these practices: 
* 52 have codes that provide examples of disciplinary consequences, for 
example, warning, counseling, and employment termination. 

FAR standard: Timely disclosure; 
Contractors reporting these practices: 
* Before FAR rule, 34 had a policy for voluntary disclosure to DOD of 
contract-related violations and misconduct; 
* Post FAR rule, 4 contractors we visited for follow-up changed 
disclosure policy and procedure to comply with new mandatory disclosure 
requirement. 

Source: GAO analysis of contractor survey. 

Notes: At the time of our survey, contracts for the acquisition of 
commercial items and those that would be performed entirely outside the 
United States were exempt from the requirements shown in the table, and 
none of the contractors were required to timely disclose credible 
evidence of certain violations of federal criminal law or of the civil 
False Claims Act. In addition, all small businesses are exempt from the 
FAR requirements for an ethics awareness and compliance program and an 
internal control system. In this table and throughout this report, we 
present data on the number of affirmative responses and not data on the 
number of "no" and "don't know" responses or the number of contractor 
nonresponses to a question. 

[End of table] 

Views of contractors surveyed were mixed with regard to the benefits 
and challenges they face in implementing the FAR contractor ethics 
rules. Contractors responding to our survey cited several expected 
benefits and challenges of the new ethics rules. Other benefits and 
challenges were attributed by the FAR Council to public comments from 
contractor industry and other sources when finalizing the new FAR 
contractor ethics rules in 2008. Some of these benefits and challenges 
are highlighted in table 3. 

Table 3: Highlights of GAO Contractor Survey and FAR Public Comments 
regarding Benefits to Contractors and Challenges They Face in 
Implementing FAR Ethics Rules: 

Contractor benefits from implementing FAR ethics rules: 
* Codify good business practices for all contractors and reinforce 
importance that all businesses conduct themselves in an ethical manner; 
* Contribute to a company culture emphasizing business integrity; 
* Provide standard and create a level playing field; 
* Build employee trust and confidence; 
* Reduce contractor liability and risk; 
* Assist contractors subject to similar responsibilities or federal 
sentencing guidelines if accused of crimes; 
* Benefit the government procurement process as a whole; 
* Reinforce companies' compliance standards and inhibit unethical 
conduct; 
* Provide basis for government partners to evaluate contractor's 
responsibility and are meaningful for enforcement when something goes 
wrong. 

Contractor benefits from implementing FAR ethics rules: 
Mandatory disclosure: 
* In contrast to existing government programs and contractor 
initiatives offering ample incentives to voluntarily report contract 
violations, mandatory disclosure may eliminate the ability of a 
contractor to claim the benefit of "timely and voluntary disclosure" to 
the government if the contractor is charged with a crime; 
* Failure to disclose an overpayment on a government contract may 
create operational difficulties because (1) contracts are subject to 
reconciliation processes with payments audited and adjusted over time 
and (2) the routine nature of contract payment issues, which are daily 
events, with errors on both sides, is simply unworkable; 
* Challenge to interpret vague language, such as "suspected," 
"cooperation," "timely," and "reasonable grounds to believe," may tie 
up government resources in meaningless legal trivia; 
* If contractor employees know that everything they report will be 
passed on to the government, this may result in less reporting up the 
chain of the company rather than more and could decrease rather than 
enhance cooperation with company ethics compliance efforts; 
Other challenges: 
* Expanding our awareness program to keep pace with our company growth; 
* Ensuring sufficient training for significant number of employees; 
* Executing the requirement for checking the existence of subcontractor 
ethics awareness and internal control systems; 
* Utilizing a covered subcontractor outside the United States, as we 
would expect that many foreign companies may not have programs that are 
as stringent as is required by the FAR, and it could be difficult in 
some countries to fund a subcontractor with such a program. 

Sources: GAO analysis of contractor survey and 73 Fed. Reg. 67064-93. 

[End of table] 

With regard to the new FAR rule's mandatory timely disclosure of 
certain contract-related violations of criminal law or the False Claims 
Act, several contractors responding to our survey as well as industry 
concerns cited in public comments indicated that contractors would face 
significant difficulty in implementing those requirements. In response 
to these concerns, the FAR Council revised key aspects of the final 
rule regarding timely disclosure, including to: 

* more closely focus the situations that must be disclosed by limiting 
violations of criminal law to certain violations involving fraud, 
conflict of interest, bribery, or gratuity violations that have 
occurred in connection with the award, performance, or closeout of a 
contract or subcontract; 

* make "credible evidence" the standard for when timely disclosure 
should occur; 

* add clarification that if a violation relates to more than one 
government contract, the contractor may make the disclosure to the 
agency officials responsible for the largest dollar value contract 
affected by the violation; and: 

* limit the application of suspension or debarment to undisclosed 
overpayment cases in which the amount is significant.[Footnote 15] 

Contractors' Ethics Program Practices: 

Highlighted below is some of the aggregated analysis resulting from the 
survey about contractors' ethics practices. A more complete tabulation 
of survey questions together with tables indicating the levels of 
response can be found in the e-supplement to this report, found on our 
Web site at [hyperlink, 
http://redesign-www.gao.gov/special.pubs/gao-09-646sp/index.html]. 

Nearly All Contractors Report Having a Code of Business Ethics and 
Conduct: 

One purpose of a code of conduct can be to communicate a company's 
statement of ethical values and integrity as established by top 
leadership. Although the FAR does not specify what topics a contractor 
must include in its code of conduct, they can cover a broad range of 
business ethics and conduct standards, such as conflict of interest, 
relationships with vendors, and compliance with government contracting 
requirements for procurement integrity, classified information, and 
recruiting and employing current or former government personnel, 
according to sources on government contractor ethics practices. 
[Footnote 16] As shown in table 4, nearly all of the contractors 
reported using such practices. 

Table 4: Contractor Responses on Practices Now Required by the FAR for 
Code of Business Ethics and Conduct: 

FAR standard: Written code of business ethics and conduct; 
Contractors reporting this practice: 
* 55 report having written codes; 
* 49 report that their codes include standards of business ethics and 
conduct expected of employees in their work on DOD contracts. 

FAR standard: Copy of the code available to employees engaged in 
contract performance; 
Contractors reporting this practice: 
* 54 provide written or electronic copies of code to employees; 
* 51 require employee acknowledgment that they understand code; 
* 52 require employees to agree to uphold the ethics standards. 

Source: GAO analysis of contractor survey. 

Note: At the time of our survey, contracts for the acquisition of 
commercial items and those that would be performed entirely outside the 
United States were exempt from the requirements for the code of 
business ethics and conduct. 

[End of table] 

Nearly All Contractors Report Having an Ethics Awareness Program, 
Compliance Program, or Both: 

One purpose of ongoing contractor ethics awareness and compliance 
programs can be to promote conformance with the code of business ethics 
and requirements. Such programs should include reasonable steps to 
communicate periodically to employees about the contractor's ethics 
standards and procedures via training programs and communicating 
information on individuals' roles and responsibilities under the ethics 
program. As shown in table 5, nearly all of the contractors reported 
including steps such as requiring ethics training and periodically 
communicating ethics-related information to employees working on DOD 
contracts. 

Table 5: Contractor Responses on Business Ethics and Awareness 
Practices for Communicating Information concerning Individual Roles and 
Responsibilities: 

FAR standard: Have ongoing ethics awareness programs, ethics compliance 
programs, or both; 
Number of contractors reporting this practice: 55. 

FAR standard: Training required for contractors' principals and 
employees and, as appropriate, the contractors' subcontractors: 

* Principals (officers, directors, executives, etc.); 
Number of contractors reporting this practice: 48. 

* Midlevel managers; 
Number of contractors reporting this practice: 51. 

* Permanently hired employees; 
Number of contractors reporting this practice: 50. 

* Short-term employees; 
Number of contractors reporting this practice: 37. 

* Independent contractors/consultants; 
Number of contractors reporting this practice: 12. 

* Employees working overseas; 
Number of contractors reporting this practice: 41. 

* Foreign employees; 
Number of contractors reporting this practice: 38. 

* Subcontractor employees; 
Number of contractors reporting this practice: 4. 

FAR standard: Periodic communication mechanisms to disseminate 
information appropriate to individuals working on contracts on their 
ethics roles and responsibilities: 

* Orientation; 
Number of contractors reporting this practice: 54. 

* Staff meetings; 
Number of contractors reporting this practice: 43. 

* Brochures; 
Number of contractors reporting this practice: 36. 

* One or more other communication mechanisms (newsletter, e-mail, 
posters, etc.); 
Number of contractors reporting this practice: 55. 

Source: GAO analysis of contractor survey. 

Notes: The standards reflected in the FAR establish a framework for 
institutional ethics management and are displayed above in bold. As 
shown in the bulleted text above, because the FAR does not prescribe 
specific ethical requirements, our survey included multiple-choice 
questions about the types of (1) employees to whom contractors provided 
ethics training and (2) periodic communication mechanisms used. 

[End of table] 

All 41 contractors that reported having overseas contract operations 
indicated that they had incorporated their ethics awareness and 
compliance programs overseas. However 26 contractors reported 
experiencing challenges implementing ethics programs overseas, 
including differences in legal and regulatory environments relating to, 
for example, employee privacy, cultural and language barriers, and 
technical or hostile conditions impeding computer-based training. 

Internal Control Systems: 

Having contractors implement internal control systems increases the 
likelihood that their ethics and compliance programs are generally 
effective in preventing, detecting, and addressing contract-related 
fraud, waste, and abuse. Nearly all of the contractors in our survey 
reported using internal control practices consistent with the FAR's 
standards. 

* High-level of management oversight. By assigning responsibility at a 
sufficiently high level and providing adequate staffing to ensure the 
effectiveness of the ethics program, a contractor can demonstrate true 
interest and involvement of management.[Footnote 17] As shown in table 
6, most contractors report formally assigning responsibility and staff 
resources to an office or individual and several have their ethics 
managers report on a regular basis to top management. Site visits with 
four contractors showed that all had ongoing and active high-level 
management oversight of their ethics programs. 

Table 6: Contractor Responses on Assignment of Ethics Program 
Responsibility and High-Level Oversight: 

Practice: Formally assign responsibility to an office or individual to 
implement ethics and compliance program; 
Number of contractors reporting this practice: 52. 

Practice: Regular reporting about business ethics awareness and 
compliance to these management levels: 

* Chief executive officer; 
Number of contractors reporting this practice: 25 (quarterly); 7 
(monthly). 

* President; 
Number of contractors reporting this practice: 17 (quarterly); 4 
(monthly). 

* Board of directors; 
Number of contractors reporting this practice: 15 (quarterly); 0 
(monthly). 

* Board ethics committee, compliance committee, or both; 
Number of contractors reporting this practice: 10 (quarterly); 0 
(monthly). 

Source: GAO analysis of contractor survey. 

Notes: The standards reflected in the FAR establish a framework for 
institutional ethics management. Because the FAR does not prescribe 
specific ethical requirements for assignment of responsibility at high 
levels for program responsibility or management oversight, our survey 
included open-ended and multiple-choice questions about the types of 
(1) individuals or offices responsible for the ethics and compliance 
program and (2) periodic reporting to various management levels. At the 
time of our survey, contracts for the acquisition of commercial items 
and those that would be performed entirely outside the United States 
were exempt from the internal control system requirements for 
management oversight. Although the FAR exempts small businesses from 
the internal control system requirements, nearly all contractors told 
us that they are not small businesses. However, if a contractor did not 
report assigning responsibility to implement an ethics and compliance 
program, we did not verify whether the company might fall under the 
commercial item or overseas exemptions. 

[End of table] 

* Periodic reviews and audits. An internal control system should be 
reviewed regularly from a compliance perspective through periodic risk 
assessments and audits.[Footnote 18] Most of the contractors reported a 
range of practices for periodic reviews and audits, as shown in table 
7. In the case of our four site visits, we confirmed that all four 
contractors had internal audits or reviews of their ethics program as 
recently as 2008. Examples of risk areas addressed by these 
contractors' internal ethics program audits include procurement 
integrity, foreign corrupt practices, and compliance with the code of 
conduct and policy for employee background checks. 

Table 7: Contractor Responses on Periodic Reviews and Audits: 

Practice: Internal audit or review function that audits business ethics 
program; 
Number of contractors reporting this practice: 52. 

Practice: Mechanisms to monitor effectiveness of ethics program: 

* Periodic evaluation of business practices, procedures, policies, and 
internal controls; 
Number of contractors reporting this practice: 52. 

* Periodic assessments of the risk of improper or criminal conduct; 
Number of contractors reporting this practice: 47. 

* Program modifications in response to risk assessment to reduce risk 
of improper or criminal conduct; 
Number of contractors reporting this practice: 46. 

* Monitoring and auditing to detect improper or criminal conduct; 
Number of contractors reporting this practice: 49. 

Source: GAO analysis of contractor survey. 

[End of table] 

* Internal mechanism for reporting misconduct. Having and publicizing a 
system such as a hotline through which employees can anonymously and 
confidentially report or seek guidance facilitates detecting and 
addressing unethical and illegal activity related to contracts and 
helps promote a culture that encourages ethical conduct and a 
commitment to compliance with the law.[Footnote 19] As shown in table 
8, most of the contractors reported having such mechanisms and policies 
for employees to anonymously or confidentially report suspected 
misconduct and contract-related violations. 

Table 8: Contractor Responses on Anonymous/Confidential Reporting of 
Misconduct and Contract-Related Violations: 

Practice: Policy for employees to anonymously and/or confidentially 
report known or suspected conduct that violates ethics standards or 
contract-related requirements; 
Number of contractors reporting this practice: 54. 

Practice: One or more mechanisms for reporting such known or suspected 
conduct; 
Number of contractors reporting this practice: 55. 

Practice: One or more mechanisms for reporting such known or suspected 
conduct: 

* Hotline/helpline; 
Number of contractors reporting this practice: 54. 

* Ethics officers; 
Number of contractors reporting this practice: 45. 

* Ethics/compliance office telephone number; 
Number of contractors reporting this practice: 49. 

* E-mail; 
Number of contractors reporting this practice: 53. 

Source: GAO analysis of contractor survey. 

[End of table] 

In addition, of the 57 contractors responding to our survey, 45 
reported using one or more mechanisms (for example, posters or 
training) to let employees know about external mechanisms for reporting 
contract-related misconduct, such as DOD IG's hotline, and 55 reported 
notifying employees of their federal whistleblower protections through 
one or more mechanisms, such as their ethics codes or training. 
[Footnote 20] 

* Disciplinary systems. A disciplinary system is part of providing 
appropriate incentives to perform in accordance with the ethics and 
compliance program and further demonstrates appropriate follow-through 
in investigating, disciplining, and correcting ethics 
violations.[Footnote 21] As shown in table 9, 53 of the 57 contractors 
report including a disciplinary system in their ethics programs, with 
consequences ranging from warning to termination practices. To ensure 
that prompt corrective measures are carried out when violations are 
substantiated, 35 of the contractors reported such practices as having 
specific offices or individuals, while 12 reported having committees, 
responsible for coordinating and tracking that appropriate discipline 
is administered. Site visits with 4 contractors confirmed that all 4 
kept extensive records for management to track and oversee disciplinary 
actions by category of conduct violation, employee category, and 
business unit. 

Table 9: Contractor Responses on Ethics-Related Disciplinary Action: 

Practice: Code of ethics states that there will be disciplinary 
consequences for conduct that violates organization's business ethics 
and standards; 
Number of contractors reporting this practice: 53. 

Practice: Code of ethics provides examples of potential disciplinary 
consequences, such as warning, counseling, and employment termination; 
Number of contractors reporting this practice: 52. 

Source: GAO analysis of contractor survey. 

[End of table] 

Timely Disclosure: 

Since the FAR rule mandating timely disclosure of contractors' credible 
evidence of violations was not yet in effect at the time of our survey, 
we asked contractors about policies for voluntarily disclosing to DOD 
conduct in connection with defense contracts that may violate 
applicable requirements of law or regulation. Of the 57 contractors 
responding to the survey, 39 indicated that they had self-reporting 
policies. Of these, 34 said that their policy was to voluntarily 
disclose or self-report violations to government officials, such as DOD 
IG, contracting officers, DCMA, and DCAA. Fifteen of these contractors 
provided copies of their self-reporting policies. Of the 18 that 
indicated that they did not have self-reporting policies, 10 said it 
was their practice to self-report or voluntarily disclose, or to 
encourage the practice of self-reporting, violations to government 
officials. In addition, some of the contractors that had self-reporting 
policies reported that the types of contract-related violations subject 
to their self-disclosure policies and practices included: 

* violations of law and instances of significant employee misconduct, 

* instances where there may have been overbilling caused by employee 
mischarging and other instances of misconduct, 

* violation of the Anti-Kickback Act of 1986, 

* compromise of product integrity, 

* violations of federal procurement law, 

* violations that added costs to the government, 

* cost accounting violations, and: 

* suspected fraud. 

Notably, in site visits with four contractors following the November 
2008 publication of the FAR's mandatory rule for timely disclosure of 
certain contract-connected violations, senior ethics program managers 
provided us information showing that all organizations were changing 
their voluntary disclosure policies to implement this new FAR 
requirement. 

New FAR Rules May Improve DOD Oversight of Contractor Ethics Programs 
in Some Areas but Not Others: 

In response to the new FAR rules, DOD has made changes in two key areas 
that could improve oversight of contractor ethics programs. 
Specifically, DCAA revised its contract audit guidance to cover the new 
FAR ethics requirements. In addition, DOD IG established the new 
Contractor Disclosure Program to implement the new mandatory disclosure 
requirement. However, additional opportunities exist to improve DOD's 
oversight in two other key areas. For example, in a third area DOD has 
not assigned responsibility for verifying implementation of contractor 
ethics programs during contract administration. The impact of the FAR 
rules on oversight at this point is negligible because the authority 
for oversight is not explicit nor is organizational responsibility 
clear. In a fourth area--hotline poster displays--the new FAR rules 
could have the adverse consequence of reducing DOD's awareness of 
potential ethics violations. Under the rules, contractors have been 
exempted from the requirement to display DOD hotline posters if they 
have their own internal hotlines. This is important because if 
contractor employees make reports of contract-related fraud, waste, and 
abuse to the company hotlines instead of DOD hotlines, DOD will be less 
aware of potential problems. In addition, if employees use contractor 
hotlines instead of DOD hotlines, the employees do not receive the same 
protections from whistleblower laws. 

DCAA Developed New Audit Guidance on Internal Controls for Contractor 
Integrity and Ethical Values: 

Although DCAA provides a range of services to contracting officers and 
other DOD officials, DCAA's primary function is contract audit 
services.[Footnote 22] As part of its ongoing oversight of contractor 
performance during the contract administration phase, DCAA's field 
audit offices conduct periodic audits of contractor internal control 
systems. In carrying out such contract audits, DCAA personnel are to 
follow the standards, policies, and techniques prescribed in the DCAA 
Contract Audit Manual (CAM).[Footnote 23] 

Senior headquarters policy and planning managers responsible for DCAA's 
auditing standards indicated that the impact of the FAR contractor 
ethics rules on DCAA contract audits has been to improve audit 
guidance. To incorporate the December 2008 FAR ethics rules into its 
audits of contractor controls for integrity and ethical values, in July 
2009 the agency distributed to its field audit offices revisions of a 
section of the CAM and its associated audit program.[Footnote 24] 
Earlier in June 2009, when the Chief, Auditing Standards Division 
updated us on the status of extensive revisions then under way to 
improve the CAM audit guidance, she indicated that the revised guidance 
under development would integrate the new FAR standards into DCAA's 
auditing program. This was a change by DCAA since February 2009 when 
headquarters officials told us that they planned to make only minor 
changes. In their view, this was because many of the new FAR 
requirements were already in the DFARS section upon which the earlier 
audit program was based. 

When we subsequently discussed preliminary findings to that effect in 
June 2009, the Chief, Auditing Standards Division told us that the 
agency had reconsidered its approach and was then proceeding to develop 
much more extensive audit guidance revisions than what had earlier been 
anticipated. In July 2009, DCAA provided us with its revised audit 
guidance, including the section of the CAM on controls for contractor 
integrity and ethical values and the associated audit program. DCAA's 
new guidance now integrates the FAR standards into DCAA's auditing 
program for identifying potential internal control deficiencies in 
contractors' ethics and compliance programs. 

DOD IG Established Contractor Disclosure Program as Required by New FAR 
Rule: 

The new FAR rule's requirement that contractors timely disclose 
credible evidence of certain violations of federal criminal law or 
violations of the civil False Claims Act made it necessary in December 
2008 for DOD IG to replace its Voluntary Disclosure Program with the 
new Contractor Disclosure Program. According to the program's manager, 
DOD's new contractor disclosure process provides: 

* contractors with Web-based and alternative means to report violations 
in writing; 

* coordinated evaluation of criminal, civil, and administrative actions 
with Department of Justice (DOJ) and DOD stakeholders (including 
offices for the Army, Navy, and Air Force suspension and debarment 
authorities and buying agencies or weapon systems affected by the 
disclosure); 

* a framework for the government to verify and, when appropriate, act 
on certain violations discovered through contractor self-policing; and: 

* centralized management combined with decentralized execution and 
faster turnaround of the investigative and prosecution processes. 

To implement the new FAR rules, DOD took immediate steps--none of which 
existed under the Voluntary Disclosure Program--to direct reporting of 
all contractor disclosures to the Contractor Disclosure Program. 
[Footnote 25] DOD IG also made early instructions available to 
contractors on submitting information via the Contractor Disclosure 
Program Web site and, in February 2009, issued a contractor's guide to 
submitting a disclosure.[Footnote 26] The guide states that disclosures 
are made with no advance agreement regarding possible DOD resolution of 
the matter and with no promises from DOJ regarding potential civil or 
criminal actions. In the event of disclosures of potential criminal 
liability, however, prompt disclosure, full cooperation, complete 
access to necessary records, restitution, and adequate corrective 
actions are key indicators to DOD of an attitude of contractor 
integrity. DOD IG is also developing instructions--to be issued in 
2009--to provide internal guidance on various DOD contractor oversight 
agencies' roles and responsibilities under the Contractor Disclosure 
Program. The instructions call on the agencies to extensively 
coordinate and share management of the investigation/prosecution 
processes. 

Before the new program, the DOD Voluntary Disclosure Program-- 
administered by DOD IG since 1986--had been largely ignored by 
contractors for the past 10 years, according to comments received by 
the FAR Council from DOJ and inspectors general. The number of 
contractor disclosures to the Voluntary Disclosure Program fell steeply 
over its 22-year history, declining from about 40 to 60 voluntary 
disclosures accepted per year in its early years to only 9 voluntary 
disclosures accepted in 2008.[Footnote 27] According to the program's 
manager, in the first 7 months since the mandatory program's start-up 
in December 2008, DOD has received 41 disclosures from contractors. 
[Footnote 28] 

DOD IG headquarters officials told us that the agency will include 
information on the Contractor Disclosure Program--such as the volume, 
nature, and disposition of active and closed disclosure cases--as part 
of its semiannual report to Congress.[Footnote 29] 

New FAR Rules Do Not Call for Verifying Implementation of Contractor 
Ethics Programs during Contract Administration: 

The FAR does not specifically require contracting officials to conduct 
oversight of contractors' ethics programs during contract 
administration, for example, verifying that the contractor has 
implemented the new mandatory contractor business ethics requirement. 
In contrast, in certain other areas of the acquisition process the FAR 
provides guidance for contracting personnel regarding contractor 
oversight that could serve as a model for DOD to use in considering 
whether to step up oversight of contractor ethics programs during 
contract administration. This guidance identifies several areas for 
which express responsibility is assigned to contracting officials for 
verifying contractor compliance with applicable laws and regulations. 
These areas include activities related to environmental practices and a 
drug-free workplace. In addition, guidance is provided to contracting 
personnel regarding, as applicable, quality assurance and safety, both 
of which are cited in the FAR as general standards for determining 
whether a prospective contractor is responsible, just as having a 
satisfactory record of integrity and business ethics is a 
responsibility standard.[Footnote 30] Such oversight during contract 
formation and administration is done, in part, to avoid any adverse 
impacts on contract performance or cost after contract award. 

As DOD's lead contract administration agency, DCMA provides a range of 
services to contracting officers and other DOD officials after contract 
award.[Footnote 31] If assigned to do so by a contracting officer as 
part of DCMA's contract administration responsibilities after contract 
award, DCMA monitors contractor performance and management systems to 
ensure that cost, quality, and schedule are in compliance with the 
terms and conditions of the contracts.[Footnote 32] DCMA's monitoring 
is primarily performed by an administrative contracting officer (ACO) 
located in the field at a contract administration office (CAO) who is 
assigned to administer the contract with assistance from engineers and 
other specialists at DCMA.[Footnote 33] To specifically combat 
procurement fraud with a strong focus on assisting CAOs through 
coordination of remedies and process improvement, DCMA also has a 
Contract Integrity Center--operated by its Office of General Counsel-- 
with attorneys geographically dispersed across the United States. 
According to DCMA, these contracting integrity attorneys work full-time 
on the prevention, detection, investigation, and prosecution of 
allegations of procurement fraud and other misconduct. 

Despite DCMA having the important role of performing contract 
administration services for many of DOD's contracts after award, the 
impact of the new FAR rules on changing the CAO function to include 
some degree of oversight to verify implementation of contractor ethics 
programs has been negligible. For example, most of the nine CAO staff 
we talked to who provide ongoing contract administration and oversight 
of seven major DOD contractors told us that they may receive 
information from the contractors or from DCAA on the status of 
contractors' ethics programs. In addition, they monitor contractor 
ethics program actions to correct internal control deficiencies for 
integrity and ethical values in response to deficiencies discovered 
during DCAA audits. However, other than reacting as information comes 
to them from the contractor and DCAA, the CAO staff indicated that they 
were not planning to routinely verify contractor ethics program 
efforts. Some of these staff indicated that they were willing to 
monitor contractors' ethics programs but noted that it is currently not 
required by the FAR. Some staff indicated that if such a task was 
required, criteria or instructions on what to look for would be needed. 
However, the new FAR rules are silent with regard to contracting 
officer review or standards for examining contractor ethics programs 
during contract administration. As such, without further guidance, CAO 
staff will continue as before the new FAR rules were implemented with 
limited oversight of contractors' ethics programs. 

Before the FAR requirements were finalized in 2008--and Congress 
mandated that we report on the extent to which DOD monitors or approves 
defense contractors' ethics programs--we previously recommended in 2005 
that DOD needs to obtain more knowledge of contractors' standards of 
conduct efforts and that enhanced awareness of contractor ethics 
programs would enable DOD to assess whether the public trust is 
protected.[Footnote 34] We recommended that DOD take actions to improve 
its knowledge and oversight of contractors' ethics programs. DOD 
commented that the recommendation was currently implemented when 
contracting officers make, prior to awarding a contract, an affirmative 
determination of responsibility, which included consideration of the 
potential contractor's business practices and the potential 
contractor's integrity. As we then indicated in response to DOD's 
comment, more could be done through assessments of contractor ethics 
programs to enhance contracting officers' ability to make such 
determinations. 

Four years later, with the FAR rules having been significantly 
expanded, DOD has not determined what if any changes are needed to its 
oversight of contractor ethics programs during contract administration. 
The FAR Council disposition in 2007 of public comments received from 
the initial FAR rulemaking process provides some insight into what 
contractors might expect of contracting officials' oversight of the new 
ethics program requirements. For example, the FAR Council commented 
that review of contractors' compliance would be incorporated into 
normal contract administration on a discretionary basis, but provided 
no description on how responsibility for that discretionary duty would 
be assigned or exercised.[Footnote 35] If such a review were to be 
required by DOD guidance, it could use the FAR's framework for 
contractor ethics program standards to begin to provide a basis for 
DCMA or other contracting officials to verify that a contractor has 
established the type of internal ethics and compliance program to be 
expected. This, in turn, would provide some assurance that contractors 
are following ethics programs as expected by the FAR Council to help 
prevent, detect, and timely disclose contract-related fraud, waste, and 
abuse. 

Beyond the issue of authority, there is no consensus among DOD 
contractor oversight officials on where organizationally such 
responsibility for verifying the implementation of the new FAR ethics 
program requirements during contract administration would be assigned. 
Some of DCMA's CAO staff that we spoke with at several of DOD's largest 
contractor facilities said that oversight of contractor ethics program 
compliance would fit into their contract administration area of 
responsibility. Other contractor oversight officials at DOD IG, DCAA, 
and the Office for the Under Secretary of Defense for AT&L told us that 
verifying or monitoring DOD contractor ethics programs would logically 
fit with DCMA's contract administration services. 

DCMA headquarters officials, however, stated that it is not their 
agency's functional responsibility to verify compliance with the new 
contractor ethics requirements. One senior DCMA headquarters official 
indicated that it would be better to assign responsibility for this 
function to DCAA's contract audit services that assess the adequacy of 
contractor internal controls for integrity and ethical values.[Footnote 
36] In addition, assigning this function to DCMA alone would leave some 
defense contractors unaddressed because DCMA is not delegated 
management responsibility for all defense contracts, according to its 
headquarters officials.[Footnote 37] Rather, CAO staff at DCMA's field 
locations oversee just those contracts and perform contract 
administration as assigned to them by procuring contracting officers at 
DOD's buying offices. Thus, for many of DOD's contractors, the contract 
administration function is retained by the procuring contracting 
officer. As a result, other contracting officials across DOD procuring 
offices would need to examine any contractors not covered by DCMA CAO 
staff. 

Not Requiring Display of DOD Hotline Posters Could Delay or Lessen 
DOD's Awareness of Problems and Use of Whistleblower Protections: 

Under the FAR rule effective in December 2007, defense contractors are 
not required to display DOD IG's fraud hotline posters if the 
contractors' ethics and compliance programs include reporting 
mechanisms such as their own hotline posters.[Footnote 38] According to 
a FAR Council response to public comments in finalizing the agency 
hotline display rule in 2007, the exemption was to mirror earlier DFARS 
guidance, which permitted contractors to post their own hotline 
posters, in lieu of DOD hotline posters, to provide an outlet for 
employees to raise issues of concern.[Footnote 39] This exemption has 
two potential adverse consequences for DOD oversight of defense 
contractors: lessening DOD's awareness of problems and diminishing 
contractor employee awareness of whistleblower protections. 

The display of the standard hotline posters available to contractors 
from DOD IG, shown in figure 1, at contractor work sites is part of 
DOD's efforts to fight procurement and other types of fraud, waste, and 
abuse. 

Figure 1: DOD Hotline Posters Available for Contractor Display: 

[Refer to PDF for image: illustration] 

The text on the first of two posters depicted: 

Dept. of Defense Hotline For Reporting Fraud, Waste and Abuse: 
800-424-9098: 

Or Write: 

Defense Hotline: 
The Pentagon: 
Washington, DC 20301-1900: 

E-Mail us at hotline@dodig.mil or visit our Website at 
http://www.dodig.mil/hotline. 

The text on the second of two posters depicted: 

Hotline: 
E-Mail: hotline@dodig.mil: 
800-424-9098: 

Defense: 
The Pentagon: 
Washington, DC 20301-1900: 

Department of Defense: 
www.dodig.mil/hotline: 

* Suspected threats to Homeland Security; 
* Unauthorized Disclosure (leaks) of Classified Information; 
* Fraud, Waste, and Mismanagement. 

Source: DOD IG. 

[End of figure] 

In fiscal year 2008 alone, DOD's hotline received nearly 14,000 
contacts resulting in 2,000 cases referred for investigation. However, 
because the FAR rule exempts contractors whose ethics programs include 
their own hotlines, and if more contractors opt not to display DOD's 
hotline posters, there is a risk that defense contractor employees will 
be unaware and not avail themselves of DOD's hotline. According to our 
ethics program survey, 55 of the 57 contractors report having one or 
more reporting mechanisms, such as a hotline for employees to report 
known or suspected conduct that violates ethics standards or contract 
requirements. 

The DOD hotline poster's absence from contractor work sites could also 
jeopardize use of whistleblower protections for contractor employees 
put in place by DOD in response to legislation separate from the 
development of the FAR's contractor ethics program requirements. 
[Footnote 40] Under this legislation, federal protections were 
strengthened for contractor employees against employer reprisals for 
blowing the whistle to government entities (such as DOD IG through its 
fraud hotline) on suspected gross mismanagement of or illegal 
activities on a DOD contract. The contractor internal reporting 
mechanisms, such as hotline posters required separately under the new 
FAR rules, do not provide contractor employees with the type of 
whistleblower protections that disclosure to DOD IG or to other DOD 
entities offers.[Footnote 41] 

Although DFARS, since January 2009, requires contractors to inform 
their employees in writing of these federal whistleblower rights and 
protections,[Footnote 42] without display of DOD's hotline poster in a 
contractor work site, contractor employees could unwittingly disclose 
information to the company's internal hotline, where they would not 
have federal protections in the event of employer reprisals. To 
facilitate contractor employee whistleblower protections, senior DOD IG 
headquarters officials responsible for investigations and policy agreed 
that it might be necessary to modify DOD hotline posters for display at 
contractor work sites to inform contractor employees that their federal 
whistleblower protections are limited to disclosures to government 
entities only. 

According to FAR Council responses to public comments received while 
finalizing the hotline display rule, it is the responsibility of the 
agency inspector general to determine the need for, and the contents 
of, the fraud hotline poster. Given the magnitude of DOD's contract 
dollars spent each year, with tens of thousands of contractors and 
ongoing efforts by DOD through its Panel on Contracting Integrity to 
reduce vulnerabilities to procurement fraud, we asked DOD IG, DCAA, 
suspension and debarment, and AT&L contractor oversight officials for 
their views.[Footnote 43] Specifically, we asked about the risk of 
defense contractors not displaying DOD hotline posters and whether the 
hotline poster's absence in workplaces where DOD contracts are 
performed might impinge on DOD's ability to timely address contractor 
violations. Several of the DOD oversight officials were not aware of 
the FAR's exemption regarding display of the DOD hotline posters until 
we told them. 

Once informed, some of these DOD officials expressed concern that the 
hotline poster's absence was not in the best interest of reducing DOD's 
vulnerability to procurement fraud. DOD IG officials agreed that 
changing DFARS to require all defense contractors to display the DOD 
hotline poster should occur. Nearly all of the 57 contractors we 
surveyed appear positioned to detect problems because they report 
having mechanisms such as hotlines for employees to report problems. 
However, the DOD IG team leader for military reprisal investigations 
expressed concern that contractor employees may be uncomfortable 
reporting to their companies' internal hotlines, an indication that 
relying only on contractor reporting mechanisms could also result in 
DOD not finding out about the problems at all. Moreover, relying on 
contractor mechanisms could also delay DOD's awareness of such problems 
and its efforts to verify and act on suspected violations. For example, 
under the new FAR rules, the length of time it takes a contractor to 
determine if there is credible evidence of a violation subject to 
mandatory disclosure requirements could affect DOD's awareness of a 
problem.[Footnote 44] With the DOD hotline, DOD has immediate awareness 
of potential violations from contractor employee calls. While there 
might be practical reasons for continuing to exempt some defense 
contractors with their own hotlines from displaying DOD's hotline 
poster, such as avoiding the confusion or duplication that could occur 
with too many hotline posters on display in one place, senior contract 
policy officials in the Office of the Under Secretary of Defense for 
AT&L believe that further study is warranted of possible changes in 
DFARS to more fully protect defense contracting integrity.[Footnote 45] 

Conclusions: 

The FAR requirements provide new direction for defense contractor 
ethics programs and present DOD opportunities to improve its oversight 
of these programs. The new rules seek to promote organizational 
cultures that encourage ethical behavior as well as promote compliance 
with the law. Our survey completed in 2009 shows that nearly all of the 
57 major defense contractors reviewed included many of the ethics 
program practices before the FAR rules were finalized consistent with 
the standards later required for compliance. DOD, in turn, is making 
positive changes to address some of the new FAR requirements. 

However, additional opportunities exist to improve DOD's oversight in 
two key areas. The first is in the area of verifying the existence of 
contractor ethics programs after contract award as part of contracting 
officers' contract administration responsibility. The need for new 
oversight attention and guidance across DOD in the area of contract 
administration has not been clearly identified or determined. Such 
additional oversight of contractor ethics programs during contract 
administration could help ensure that contractor ethics programs are in 
place as intended. 

The second is in the area of DOD's hotline program, for improved 
oversight for potential contract-related fraud, waste, and abuse. The 
new FAR contractor ethics rules have the potential to make the hotline 
program less effective by ultimately reducing contractor exposure to 
DOD hotline posters and diminishing the means by which fraud, waste, 
and abuse can be reported under the protection of federal whistleblower 
laws. Nearly all of the major contractors surveyed have in-house ethics 
and compliance programs that exempt them from displaying the DOD 
posters. It is conceivable that virtually no major contractor would be 
required to display the DOD hotline posters. Contractor employees might 
be reluctant to report violations to an in-house hotline that did not 
provide federal protection against company retaliation. However, 
employees do have such protection when reporting directly to the DOD 
hotline. 

Recommendations for Executive Action: 

We are recommending four actions aimed at improving DOD's oversight of 
defense contractors' ethics programs. First, to strengthen oversight 
during contract administration, we recommend that the Secretary of 
Defense direct the Under Secretary of Defense for AT&L to determine 
what if any new DFARS or other guidance is needed to clarify functional 
responsibilities of DCMA and other contracting officials during 
contract administration for verifying the implementation of contractor 
ethics programs as required under the FAR ethics rules. 

To avoid delaying or lessening DOD IG awareness of contract-related 
problems and diminishing of whistleblower protections for contractor 
employees, we recommend that the Inspector General for the Department 
of Defense, in accordance with the FAR, take the following two actions: 

* Determine the need for defense contractors' display of DOD IG's fraud 
hotline poster, including directing a contractor to display the DOD IG 
hotline poster in common work areas for performance of DOD contracts. 

* Determine the contents of the DOD IG's fraud hotline poster for 
display by defense contractors, including revising the poster to inform 
contractor employees of their federal whistleblower protections. 

Fourth, if the need for hotline poster display is determined by the 
Inspector General, we recommend that the Secretary of Defense direct 
the Under Secretary of Defense for AT&L to propose revisions to DFARS 
to include policy requiring a contract clause directing a contractor to 
display the DOD IG hotline poster in common work areas for performance 
of DOD contracts. DFARS policy should require a defense contractor's 
display of the DOD IG fraud hotline poster irrespective of whether that 
contractor has its own internal mechanism, such as a hotline for 
employees to report contract-related improprieties. 

Agency Comments: 

We provided a draft of this report and the e-supplement that 
accompanies it to DOD for comment.[Footnote 46] The Office of the Under 
Secretary of Defense for AT&L's Director, Defense Procurement and 
Acquisition Policy, wrote that DOD concurs with the first three 
recommendations. For example, according to the Director, the first 
recommendation will be referred to the Defense Acquisition Regulation 
(DAR) Council to establish a DFARS case to determine whether additional 
guidance is needed to clarify the administrative contracting officer's 
functional responsibilities. 

Regarding the last recommendation, the Director wrote that DOD 
partially concurs because it is not necessary (as we recommended) for 
the Panel on Contracting Integrity to propose the revisions. However, 
in response to this recommendation, the Director will submit the 
proposed revisions to DFARS via memorandum to the DAR Council. Since 
DOD's comment concurs with the substance of the recommendation, we 
revised it to better align with DOD's preferred method for 
implementation. DOD's comments are reprinted in appendix II. 

We are sending copies of this report to the Secretary of Defense, the 
DOD Inspector General, the Director of the Office of Management and 
Budget, the major defense contractors identified in this report, and 
other interested parties. The report also is available at no charge on 
the GAO Web site at [hyperlink, http://www.gao.gov]. 

If you or your staff have any questions about this report, please 
contact me at (202) 512-4841 or needhamjk1@gao.gov. Contact points for 
our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. GAO staff who made major contributions 
to this report are listed in appendix IV. 

Signed by: 

John K. Needham: 
Director, Acquisition and Sourcing Management: 

List of Congressional Committees: 

The Honorable Carl Levin: 
Chairman: 
The Honorable John McCain: 
Ranking Member: 
Committee on Armed Services: 
United States Senate: 

The Honorable Ike Skelton: 
Chairman: 
The Honorable Howard P. "Buck" McKeon: 
Ranking Member: 
Committee on Armed Services: 
House of Representatives: 

[End of section] 

Appendix I: Scope and Methodology: 

Congress included a provision in the National Defense Authorization Act 
for Fiscal Year 2008 requiring us to report on the internal ethics 
programs of major defense contractors.[Footnote 47] In January 2009, we 
briefed the Senate and House Armed Services Committees on the 
preliminary results regarding the reporting requirements specified in 
the act. After this congressional mandate, revisions to the Federal 
Acquisition Regulation (FAR) to require internal ethics programs of 
contractors were finalized. As shown in table 10's side-by-side 
comparison, ethics program elements identified by Congress for 
inclusion in this report are very similar to the contractor ethics 
program elements now required by the FAR. 

Table 10: Comparison of Ethics Program Elements in Congressional 
Mandate and FAR Requirements: 

Contractor internal ethics program elements: Written code of business 
ethics and conduct; 
Congressional mandate: [Empty]; 
FAR requirements: [Check]. 

Contractor internal ethics program elements: Internal mechanisms, such 
as hotlines, for reporting misconduct; 
Congressional mandate: [Check]; 
FAR requirements: [Check]. 

Contractor internal ethics program elements: Notification to employees 
of external mechanisms, such as the Department of Defense (DOD) 
Inspector General (IG) hotline, for reporting misconduct; 
Congressional mandate: [Check]; 
FAR requirements: [Check]. 

Contractor internal ethics program elements: Notification to employees 
of their right to be free from reprisal for disclosing a substantial 
violation of law related to a contract; 
Congressional mandate: [Check]; 
FAR requirements: [A]. 

Contractor internal ethics program elements: Ethics training programs; 
Congressional mandate: [Check]; 
FAR requirements: [Check]. 

Contractor internal ethics program elements: Internal audit or review 
programs; 
Congressional mandate: [Check]; 
FAR requirements: [Check]. 

Contractor internal ethics program elements: Requirements for self- 
reporting violations to government officials; 
Congressional mandate: [Check]; 
FAR requirements: [Check]. 

Contractor internal ethics program elements: Disciplinary action; 
Congressional mandate: [Check]; 
FAR requirements: [Check]. 

Contractor internal ethics program elements: Appropriate management 
oversight; 
Congressional mandate: [Check]; 
FAR requirements: [Check]. 

Sources: Section 848 of the National Defense Authorization Act for 
Fiscal Year 2008 and FAR Subparts 3.10, Clauses 52.203-13, and 52203-14 
(information); GAO (analysis and presentation). 

[A] We also reported on contractor employee whistleblower protections, 
which were addressed in § 846 (b)(2)(C) of the National Defense 
Authorization Act for Fiscal Year 2008, Pub. L. No. 110-181, and § 842 
(a) of the National Defense Authorization Act for Fiscal Year 2009, 
Pub. L. No. 110-417 (2008). 

[End of table] 

Given the similarity between some of the ethics program elements in our 
congressional mandate and the current FAR requirements, our audit and 
reporting objectives were to (1) describe the extent to which 
contractors had ethics programs before the finalization of the FAR 
rules that included practices consistent with standards now required by 
the FAR and (2) assess the impact the new FAR rules have on DOD 
oversight of contractor ethics programs. 

Section 848 defined a major defense contractor as any company awarded 
contracts by DOD during fiscal year 2006 in amounts totaling more than 
$500 million. To identify those contractors, we analyzed data on the 
values of contracts awarded to all companies from DOD's Statistical 
Information Analysis Division. We initially identified 65 contractors, 
but we eliminated six companies that merged or were joint ventures, as 
well as two foreign government entities from our review. Based on our 
review of DOD's data, we found that the data were sufficiently reliable 
for the purpose of identifying which contractors to include in this 
report. As a result, we identified the 57 contractors meeting the major 
defense contractor criteria to include in our review. As shown in table 
11, which ranks the 57 major defense contractors by the value of their 
fiscal year 2006 DOD contract awards, these companies accounted for 
more than half of DOD's total contract awards in 2006--$164.5 billion 
of the total $295 billion. 

Table 11: Contractors Reviewed by GAO, by Value of Total Contract 
Awards from DOD in Fiscal Year 2006 (Dollars in millions): 

Contractor: Lockheed Martin Corporation; 
Value of DOD contract awards: $26,620; 

Contractor: Boeing Company; 
Value of DOD contract awards: $21,721; 

Contractor: Northrop Grumman Corporation; 
Value of DOD contract awards: $16,627; 

Dollars in millions: Contractor: General Dynamics Corporation; 
Value of DOD contract awards: $11,942; 

Dollars in millions: Contractor: Raytheon Company; 
Value of DOD contract awards: $10,069; 

Dollars in millions: Contractor: BAE Systems PLC; 
Value of DOD contract awards: $6,192; 

Contractor: KBR, Inc.; 
Value of DOD contract awards: $6,060; 

Contractor: L-3 Communications Holding, Inc.; 
Value of DOD contract awards: $5,197; 

Contractor: United Technologies Corporation; 
Value of DOD contract awards: $4,453; 

Contractor: Science Applications International Corporation (SAIC); 
Value of DOD contract awards: $3,211; 

Contractor: Computer Sciences Corporation (CSC); 
Value of DOD contract awards: $2,884; 

Contractor: Humana, Inc.; 
Value of DOD contract awards: $2,642; 

Contractor: ITT Corporation; 
Value of DOD contract awards: $2,522; 

Contractor: General Electric Company; 
Value of DOD contract awards: $2,328; 

Contractor: Health Net, Inc.; 
Value of DOD contract awards: $2,119; 

Contractor: Triwest Heathcare Alliance Company; 
Value of DOD contract awards: $2,022; 

Contractor: Electronic Data Systems Corporation; 
Value of DOD contract awards: $2,008; 

Contractor: AM General, LLC; 
Value of DOD contract awards: $1,944; 

Contractor: Agility Logistics; 
Value of DOD contract awards: $1,838; 

Contractor: Honeywell International, Inc.; 
Value of DOD contract awards: $1,679; 

Contractor: Textron, Inc.; 
Value of DOD contract awards: $1,369; 

Contractor: URS Corporation; 
Value of DOD contract awards: $1,369; 

Contractor: Amerisourcebergen Corporation; 
Value of DOD contract awards: $1,346; 

Contractor: Harris Corporation; 
Value of DOD contract awards: $1,339; 

Contractor: FedEx Corporation; 
Value of DOD contract awards: $1,303; 

Contractor: Bechtel Group, Inc.; 
Value of DOD contract awards: $1,264; 

Contractor: Booz Allen Hamilton, Inc.; 
Value of DOD contract awards: $1,245; 

Contractor: BP America, Inc.; 
Value of DOD contract awards: $1,199; 

Contractor: Exxon Mobil Corporation; 
Value of DOD contract awards: $1,176; 

Contractor: Shell Oil Company; 
Value of DOD contract awards: $1,151; 

Contractor: Alliant Techsystems, Inc.; 
Value of DOD contract awards: $1,128; 

Contractor: Oshkosh Truck Company; 
Value of DOD contract awards: $941; 

Contractor: Rockwell Collins, Inc.; 
Value of DOD contract awards: $824; 

Contractor: Korea Agricultural Cooperative; 
Value of DOD contract awards: $761; 

Contractor: DRS Technologies; 
Value of DOD contract awards: $730; 

Contractor: Phillips & Jordon, Inc.; 
Value of DOD contract awards: $705; 

Contractor: CACI International, Inc.; 
Value of DOD contract awards: $681; 

Contractor: General Atomic Technologies Company; 
Value of DOD contract awards: $670; 

Contractor: McKesson Corporation; 
Value of DOD contract awards: $670; 

Contractor: Valero Energy Corporation; 
Value of DOD contract awards: $661; 

Contractor: Thales; 
Value of DOD contract awards: $657; 

Contractor: Aerospace Corporation; 
Value of DOD contract awards: $654; 

Contractor: Mitre Corporation; 
Value of DOD contract awards: $652; 

Contractor: Massachusetts Institute of Technology; 
Value of DOD contract awards: $640; 

Contractor: Dell, Inc.; 
Value of DOD contract awards: $636; 

Contractor: Cardinal Health, Inc.; 
Value of DOD contract awards: $635; 

Contractor: Syracuse Research Corporation; 
Value of DOD contract awards: $613; 

Contractor: Chugach Alaska Corporation; 
Value of DOD contract awards: $593; 

Contractor: Refinery Associates of Texas; 
Value of DOD contract awards: $577; 

Contractor: Environmental Chemical Corporation; 
Value of DOD contract awards: $570; 

Contractor: Parsons Corporation; 
Value of DOD contract awards: $526; 

Contractor: Johns Hopkins University; 
Value of DOD contract awards: $525; 

Contractor: Battelle Memorial Institute; 
Value of DOD contract awards: $519; 

Contractor: Shaw Group, Inc.; 
Value of DOD contract awards: $519; 

Contractor: Maersk Line Ltd.; 
Value of DOD contract awards: $516; 

Contractor: Jacobs Engineering Group, Inc.; 
Value of DOD contract awards: $505; 

Contractor: Kraft Foods, Inc.; 
Value of DOD contract awards: $501; 

Total DOD contract awards to these 57 contractors in 2006: 
Value of DOD contract awards: $164,448. 

Total DOD contract awards to all contractors in 2006: 
Value of DOD contract awards: $294,976. 

Sources: GAO (analysis); DOD (data). 

Note: The dollar value of DOD contract awards in 2006 for each 
contractor was rounded to the nearest million. 

[End of table] 

We conducted this performance audit from May 2008 through August 2009 
in accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe that 
the evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. 

The scope and methods we used to perform this audit are described in 
greater detail in the remainder of this appendix.[Footnote 48] 

First Audit Objective: 

To determine the extent to which 57 major defense contractors included 
in our review have internal ethics programs that include certain 
practices consistent with standards now required by the FAR, we 
designed and conducted a Web-based survey of all 57 contractors. To 
gain an initial understanding of the variety and scope of information 
reasonably available on the range of practices used in relation to 
internal ethics programs, we reviewed chapter 8 (Sentencing of 
Organizations) of the 2007 Federal Sentencing Guidelines Manual and 
government contract management publications for information to describe 
the FAR contractor ethics program requirements. We also interviewed 
officials from government and public entities with knowledge in this 
area, including the Defense Industry Initiative on Business Ethics and 
Conduct, the Ethics Resource Center, DOD, and the Department of 
Justice's National Procurement Fraud Task Force. 

To conduct this survey, we pretested it in July 2008 with Lockheed 
Martin Corporation, Electronic Data Systems Corporation, Agility 
Logistics, and Mitre Corporation to determine if the questions were 
clear and unbiased, if the terminology used to describe the programs 
was precise, and whether the survey questionnaire placed an undue 
response burden on companies. After revising the survey to incorporate 
pretest comments in August 2008, we sent an e-mail to all 57 
contractors in early September 2008 with instructions for accessing the 
survey and followed up with nonrespondents by e-mail and telephone to 
encourage their responses. After we closed out the survey on October 
24, 2008, congressional committee staff requested that we pursue 
responses from the remaining unresponsive contractors, and we contacted 
the contractors; reopened the survey on March 13, 2009, for 5 business 
days; and obtained their responses. 

The multisection survey was designed to address all of the ethics 
program elements identified in Section 848 and those now required by 
the FAR, as shown in table 10's side-by-side comparison. The survey was 
organized in various sections to obtain contractors' self-reported 
information on their internal ethics programs in key areas, such as (1) 
code of business ethics and conduct, (2) internal and external 
mechanisms for reporting misconduct, (3) notification to contractor 
employees of their right to be free from reprisal for disclosing a 
substantial violation of law, (4) ethics training programs, (5) 
internal audits, and (6) appropriate management oversight. GAO's e- 
supplement, GAO-09-646SP, provides the questions used for the survey as 
well as the aggregated responses. We analyzed responses from the 57 
contractors that responded to the survey--a survey response rate of 100 
percent--in comparison to the FAR requirements introduced from December 
2007 through December 2008. In addition to analyzing self-reported 
information from the survey responses, we requested that all 57 
contractors send us corroborating documentation to review for various 
practices in their internal ethics programs, including practices now 
required by the FAR, such as management oversight and ethics and 
compliance training. We did not verify implementation or test the 
effectiveness of contractor ethics program practices self-reported 
through our survey. 

We selected a nongeneralizable sample of 4 of the 57 contractors for 
site visits in order to review in detail implementation practices for 
some of the ethics program policies or procedures described in their 
survey responses, such as disciplinary actions, hotline calls, and 
ethics training programs. Our selection criteria in part were whether 
(1) the contractors were ranked among the top 15 contractors in terms 
of dollar value of DOD contracts awarded to them in fiscal year 2006 
and (2) their survey responses indicated that the contractors had such 
policies or procedures in use. We visited Boeing Company, General 
Dynamics, Computer Sciences Corporation (CSC), and Science Applications 
International Corporation (SAIC) from December 2008 through February 
2009 and obtained detailed information from senior company officials 
responsible for management of ethics program-related practices 
described in their responses to our survey. 

To determine the benefits and challenges contractors face in 
implementing the new FAR requirements, we analyzed contractor views 
from our Web-based survey. To identify views and perspectives similar 
to or different from those obtained from the survey, we reviewed 
responses to public comments prepared by the FAR Council and published 
in the Federal Register. 

Second Audit Objective: 

To assess the impact that expanded FAR contractor ethics program 
requirements have on DOD monitoring or approval of defense contractor 
ethics programs, we focused on defense and military organizations 
responsible for oversight and investigation of contractor operations 
and improper business practices: (1) Defense Contract Management Agency 
(DCMA); (2) Defense Contract Audit Agency (DCAA); (3) DOD IG; (4) the 
Air Force, Army, and Navy offices responsible for suspension and 
debarment; and (5) the Office of the Under Secretary of Defense for 
Acquisition, Technology and Logistics (AT&L). We interviewed senior 
procurement officials; general counsel; and contract administration, 
audit, and investigative service officials concerning these agencies' 
roles and responsibilities for monitoring or approving contractor 
ethics programs. Through interviews and information obtained from these 
officials, we obtained views and reviewed supporting documentation 
concerning the impact the new FAR rules have had or could have on DOD 
contractor oversight activities regarding monitoring contractors' 
compliance with ethics program practices required by the FAR rules. 

In addition, we communicated with selected officials from the DOD 
agencies listed above to obtain updates regarding changes in their 
policies and procedures to implement the expanded FAR requirements, 
reviewed available guidance and instructions these agencies developed 
to implement the FAR changes, and analyzed public comments attributed 
to DOD or other government sources and FAR Council responses published 
in the Federal Register relevant to agencies' implementation of the 
requirements. We also interviewed senior DCAA and DCMA officials 
colocated at four contractor field office locations to discuss their 
oversight of contractor ethics programs and any concerns they might 
have related to those programs on contractor performance and costs. We 
did not test DOD agencies' effectiveness in implementing their 
contractor ethics program oversight activities. 

[End of section] 

Appendix II: Comments from the Department of Defense: 

Office Of The Under Secretary Of Defense: 
Acquisition, Technology And Logistics: 
3000 Defense Pentagon: 
Washington, DC 20301-3000: 

September 16, 2009: 

Mr. John K. Needham: 
Director, Acquisition and Sourcing Management: 
U.S. Government Accountability Office: 
441 G Street, N.W. 
Washington, DC 20548: 

Dear Mr. Needham: 

This is the Department of Defense (DoD) response to the GAO Draft 
Report, GAO-09-591, "DOD Contracting Integrity: Opportunities Exist to
Improve DoD's Oversight of Contractor Ethics Programs," dated August 
21, 2009 (GAO Code 120736). 

The Department comments on the report recommendations are enclosed. 

Sincerely, 

Signed by: 

Shay D. Assad: 
Director, Defense Procurement and Acquisition Policy: 

Enclosure: As stated: 

[End of letter] 

GAO Draft Report - Dated August 21, 2009: 
GAO-09-591 (GAO Code 120736): 

"DOD Contracting Integrity: Opportunities Exist To Improve Dod's 
Oversight Of Contractor's Ethics Programs" 

Department Of Defense Comment To The GAO Recommendation: 

Recommendation 1: The GAO recommends that the Secretary of Defense 
direct the Under Secretary of Defense (Acquisition, Technology and 
Logistics) to determine what if any new Defense Federal Acquisition 
Regulation Supplement (DFARS) or other guidance is needed to clarify 
functional responsibilities of Defense Contract Management Agency 
(DCMA) and other contracting officials during contract administration 
for verifying the implementation of contractor ethics programs as 
required under the Federal Acquisition Regulation (FAR) ethics rules. 

DOD Response: Concur, The recommendation will be referred to the 
Defense Acquisition Regulation Council to establish a DFARS case to 
determine whether additional guidance is needed to clarify the 
functional responsibilities of the administrative contracting officer. 

Recommendation 2: The GAO recommends that the DoD Inspector General 
(DoD IG), in accordance with FAR, determine the need for defense 
contractors' display of the TG's fraud hotline poster to include 
directing a contractor to display the DoD IG hotline poster in common 
work areas for performance of DoD contract. 

DOD Response: Concur. 

Recommendation 3: The GAO recommends that the DoD IG, in accordance 
with FAR, determine the contents of the TG's fraud hotline poster for 
display by defense contractors to include revising the poster to inform 
contractor employees of their federal whistleblower protections. 

DOD Response: Concur. 

Recommendation 4: The GAO recommends that the Secretary of Defense 
direct the Under Secretary of Defense (Acquisition, Technology and 
Logistics) to task the DoD Panel on Contracting Integrity draft 
proposed revisions to the DFARS to include policy requiring a contract 
clause directing a contractor to display the DoD IG hotline poster in 
common work areas for performance of DoD contracts. DFARS policy should 
require a defense contractor's display of the DoD IG fraud hotline 
poster irrespective of whether that contractor has its own internal 
mechanism such as a hotline for employees to report contract-related 
improprieties. 

DOD Response: Partially concur. The FAR clause 52.203-14 already 
requires the contractor to prominently display the DoD Hotline Poster 
in common work areas within business segments performing work under the 
contract and at contract work sites with the exception noted at 
paragraph (c). The issue is the exception noted at 52.203-14(c) which 
states that if the contractor has implemented its own business ethics 
and conduct awareness program including a reporting mechanism, the 
agency fraud hotline poster need not be displayed. DPAP will submit the 
proposed revision to DFARS in a memorandum to the Director, DAR 
Council, identifying this GAO recommendation. It is not necessary for 
the Panel on Contracting Integrity to propose revisions. The DFARS team 
working this policy area will consider the GAO recommendations. 

[End of section] 

Appendix III: Required Federal Acquisition Regulation Components for 
Contractor Ethics Programs: 

The final FAR rule--effective in December 2008--reflects contractor 
ethics program standards across four broad components, as shown in 
table 12.[Footnote 49] According to the FAR Council, the rule 
establishes a framework for institutional ethics management and 
disclosure but does not prescribe specific ethical requirements. 
Contractors are free to establish the appropriate ethical standards for 
their businesses. 

Table 12: Required FAR Components for Contractor Ethics Program 
Practices: 

Component requirement: Code of business ethics and conduct; 
Description: Required for businesses with contracts or subcontracts 
over $5 million and a period of performance of 120 days or more; must 
be implemented within 30 days of contract award; must be written and 
distributed to all employees. 

Component requirement: Ethics awareness and compliance program; 
Description: Required for noncommercial item acquisitions and 
businesses that are other than "small" and with contracts or 
subcontracts over $5 million and a period of performance of 120 days or 
more; must be implemented within 90 days of contract award. The ongoing 
program shall include steps to periodically communicate the 
contractor's business ethics standards and procedures by conducting 
training programs for all employees. 

Component requirement: Internal control system; 
Description: Required for noncommercial item acquisitions and 
businesses that are other than "small" and with contracts or 
subcontracts over $5 million and a period of performance of 120 days or 
more. Among others, minimum practices required for the contractor's 
internal control system include the following. 

Component requirement: High level of management oversight; 
Description: Assignment of high-level responsibility within the 
organization and adequate resources for the ethics and compliance 
program. 

Component requirement: Periodic reviews, audits, or both; 
Description: Required to evaluate effectiveness of company business 
practices, procedures, and policies, and internal controls for 
compliance with the established code of business ethics and conduct and 
the special requirements of government contracting. 

Component requirement: Internal mechanism for reporting misconduct; 
Description: Mechanisms, such as a hotline, for employees to report 
anonymously or confidentially suspected instances of improper conduct 
and instructions that encourage employees to make such reports. Unless 
the contract is performed entirely outside the United States or is for 
commercial items, a contract clause may also be used to require display 
of agency fraud hotline posters, but the contractor need not do so if 
it has implemented an ethics program with an internal reporting 
mechanism, such as a hotline poster of its own. 

Component requirement: Disciplinary systems; 
Description: Follow through with disciplinary action for improper 
conduct or failing to take reasonable steps to prevent or detect 
improper conduct; exclude an individual as a principal who has engaged 
in conduct in conflict with the established code of ethics. 

Component requirement: Timely disclosure; 
Description: In connection with the award, performance, or closeout of 
a contract or subcontract, mandatory reporting of credible evidence of 
violations of (1) federal criminal law involving fraud, conflict of 
interest, bribery, or gratuity violations found in Title 18 of the U.S. 
Code or (2) the civil False Claims Act. For contracts or subcontracts 
over $5 million and a period of performance of 120 days or more, as 
required by contract clause, they shall timely disclose these 
violations of federal criminal law and the civil False Claims Act in 
writing to the agency Office of the Inspector General with a copy to 
the contracting officer. 

Sources: FAR Subpart 3.10, clauses 52.203-13, and 52.203-14 
(information); GAO (analysis and presentation). 

[End of table] 

[End of section] 

Appendix IV GAO Contact and Staff Acknowledgments: 

GAO Contact: 

John K. Needham (202) 512-4841 or needhamjk1@gao.gov: 

Acquisition and Sourcing Management: 

Carolyn Kirby, Assistant Director Erin Schoening, Analyst in Charge 
Myra Watts Butler, Senior Analyst Gwyneth Woolwine, Senior Analyst Erin 
Stockdale, Analyst Aglae Cantave, Analyst Ryan Stott, Analyst Intern 
Greg Campbell, Senior Communications Analyst: 

Applied Research and Methods: 

Jean McSween, Senior Social Science Analyst Walter Vance, Senior Social 
Science Analyst: 

General Counsel: 

John Krump, Deputy Assistant General Counsel: 

[End of section] 

Footnotes: 

[1] DFARS is a supplement to the Federal Acquisition Regulation (FAR) 
that provides DOD-specific regulations. Among its requirements, DFARS 
contains DOD-wide policies and deviations from FAR requirements. 

[2] GAO, Defense Ethics Program: Opportunities Exist to Strengthen 
Safeguards for Procurement Integrity, [hyperlink, 
http://www.gao.gov/products/GAO-05-341] (Washington, D.C.: Apr. 29, 
2005). In concurring with this report, DOD stated that the 
recommendation to assess contractor ethics programs was currently 
implemented when contracting officers, before awarding a contract, make 
an affirmative determination of responsibility, which includes 
consideration of the potential contractor's business practices and the 
potential contractor's integrity. 

[3] Since December 24, 2007, contractors receiving awards worth more 
than $5 million and involving work in excess of 120 days have been 
required to have a written code of business ethics and conduct. 
However, until further amended effective December 12, 2008, the rule 
did not apply to contracts for commercial items or to contracts 
performed outside the United States. 72 Fed. Reg. 65873-82 (Nov. 23, 
2007). 

[4] The National Defense Authorization Act for Fiscal Year 2008, Pub. 
L. No. 110-181 § 848. 

[5] App. I provides a side-by-side comparison in table 10 of the ethics 
program elements identified in § 848 for inclusion in this report with 
those contractor ethics program elements now required by the FAR, all 
of which became the basis for our survey on major defense contractors' 
ethics programs. Pub. L. No. 110-181 § 848 (2008). 

[6] The FAR Council--whose members include the DOD Director of Defense 
Procurement and Acquisition Policy, the National Aeronautics and Space 
Administration Associate Administrator for Procurement, and the General 
Services Administration Chief Acquisition Officer--oversees development 
and maintenance of the FAR. The Office of Federal Procurement Policy 
Administrator in the Office of Management and Budget serves as chair of 
the FAR Council, which meets quarterly to discuss and resolve 
significant or controversial FAR changes. 

[7] For purposes of this report, an improper business practice is 
defined as a known or suspected violation of federal criminal law 
involving fraud, conflict of interest, bribery, or gratuity violations 
found in title 18 of the United States Code or a violation of the civil 
False Claims Act. 

[8] 48 C.F.R. § 203.7000 (2007). 

[9] 48 C.F.R. § 203.7001 (2007). 

[10] See also GAO, Contract Management: DOD Vulnerabilities to 
Contracting Fraud, Waste, and Abuse, [hyperlink, 
http://www.gao.gov/products/GAO-06-838R] (Washington, D.C.: July 7, 
2006). 

[11] 72 Fed. Reg. 65876 (Nov. 23, 2007). 

[12] 72 Fed. Reg. 65873-82 (Nov. 23, 2007). 

[13] On June 30, 2008, Congress enacted the Close the Contractor Fraud 
Loophole Act as part of the Supplemental Appropriations Act, 2008. The 
act requires the FAR to include provisions that require timely 
notification by federal contractors of violations of federal criminal 
law or overpayments in connection with the award or performance of 
covered contracts or subcontracts, including those performed outside 
the United States and those for commercial items. Supplemental 
Appropriations Act, 2008, Pub. L. No. 110-252, Title VI, ch. 1. 

[14] FAR § 3.1004. 

[15] In finalizing the rule, the FAR Council declined to expressly 
define "significant overpayment" in response to concerns raised in the 
public comments. Instead, FAR Council comments indicated that 
"significant overpayment" implies more than just dollar value and 
depends on the circumstances of the overpayment as well as the amount. 
More specifically, it is the type of overpayment that the contractor 
knows will result in unjust enrichment and yet fails to disclose. As 
part of the comments, it was also noted that since contractors are 
required by the FAR's payment clauses to report and return overpayments 
of any amount, it is within the discretion of the suspension and 
debarment official to determine whether an overpayment is significant. 

[16] See The Defense Industry Initiative on Business Ethics and 
Conduct, 2007 Annual Public Accountability Report (Washington, D.C., 
2008); Tara A. Edwards and Frank Spasoff, "Compliance with the New FAR 
Ethics and Internal Control Requirements," Contract Management (April 
2009): 34-42; and Terrence M. O'Connor, Federal Procurement Ethics: The 
Complete Legal Guide (Vienna, Va.: Management Concepts, 2009). 

[17] Edwards and Spasoff, 40. 

[18] Edwards and Spasoff, 41, and O'Connor, 7-10. 

[19] United States Sentencing Commission, Guidelines Manual, § 8B2.1 
(November 2007). 

[20] Since January 2009, 10 U.S.C. § 2409 and 41 U.S.C. § 251 et seq. 
address protections for contractor employees who disclose information 
to government officials with regard to waste or mismanagement, danger 
to public health or safety, or violation of law related to a DOD 
contract or grant. Specifically, an employee may not be discharged, 
demoted, or otherwise discriminated against as a reprisal for 
disclosing to the government information concerning contract-related 
violations. As of January 2009, DOD regulations also require 
contractors to inform their employees in writing of these federal 
whistleblower rights and protections. DFARS Subpart 203.970. 

[21] James C. Fontana, J. Scott Hommer III, and Peter A Riesen, "The 
Brave New World of Government Contractor Compliance Programs: 
Maximizing Effectiveness and Minimizing Risk," Contract Management 
(January 2009): 48-59. 

[22] To facilitate DCAA's contract audit work, under its decentralized 
organizational structure, DCAA has field audit offices that include 
resident offices at larger contractor facilities such as those included 
in this study. 

[23] Defense Contract Audit Agency, DCAA Contract Audit Manual, DCAAM 
7640.1 (Nov. 5, 2008). 

[24] CAM 5-306--Integrity and Ethical Values, in 5-300 Section 3--Audit 
of Internal Controls--Control Environment and Overall Accounting System 
Controls. 

[25] For example, in December 2008 the Under Secretary of Defense for 
AT&L issued a memorandum to provide DOD contracting officers with 
guidance regarding implementing the FAR requirement for contractors' 
timely disclosure, in writing, to the DOD IG office of certain contract-
connected violations. The Under Secretary's memorandum expressly 
notified DOD contracting officers of the DOD IG's designation and 
address for its new Contractor Disclosure Program. AT&L also initiated 
actions that month to incorporate this guidance in DFARS. Under 
Secretary of Defense (AT&L) Memorandum, DOD Implementation of the 
Disclosure Requirement Under FAR Clause 52.203-13 (Dec. 29, 2008). 

[26] The DOD IG site at [hyperlink, http://www.dodig.mil] has Web-based 
disclosures and related guidance for the Contractor Disclosure Program. 

[27] This disclosure history does not include an unknown number of 
matters voluntarily disclosed by contractors that DOD IG did not accept 
into the Voluntary Disclosure Program. For example, a disclosure would 
not be accepted into the program if the government had prior knowledge 
of the matter(s) disclosed, such as through government audit, 
investigation, contract administration efforts, or reports to the 
government by third parties. According to the Program Manager, 
Contractor Disclosure Program, total annual voluntary disclosures 
accepted by DOD IG into the program ranged as high as 59 cases in 1988 
to as low as 3 cases in 2007. 

[28] The volume of disclosures into the Contractor Disclosure Program 
is not strictly comparable to the volume of voluntary disclosures, 
according to the program's manager. Unlike its practices under the 
Voluntary Disclosure Program, DOD IG accepts into the Contractor 
Disclosure Program all disclosures submitted from contractors. This 
would include accepting even disclosures of matter(s) that the 
government has prior knowledge of through audit, investigation, 
contract administration efforts, or reports by third parties. 

[29] As required by the Inspector General Act of 1978, as amended, DOD 
IG reports semiannually to Congress. According to DOD IG, the 
semiannual report not only provides Congress and the taxpayer with a 
detailed account of what this organization has done during each half of 
each fiscal year, it is the embodiment of two important concepts upon 
which the agency is based--accountability and transparency. 

[30] FAR subpart 9.1. 

[31] As of December 2008, DCMA reports managing 291,000 prime contracts 
valued at $950 billion. However, according to DCMA headquarters 
officials, most contracts DCMA manages pertain to major weapon system 
procurements. Not generally covered by DCMA's contract management 
services are most of DOD's services contractors, other than those on a 
limited number of services contracts related to DOD weapon systems 
maintenance and the Army's Logistics Civil Augmentation Program 
contract to support worldwide contingency operations. 

[32] After contract award, the procuring contracting officer at the 
buying office may or may not assign contract administration (i.e., 
oversight) responsibility to a separate office. If the contracting 
officer does not assign this responsibility to a separate office, 
contract administration remains the contracting officer's 
responsibility. Under the FAR, when a contract is assigned for 
administration, the contracting officer normally delegates portions of 
a list of 70 specific contract administration functions to a designated 
contract administration office (CAO). FAR Subpart 42.3--Contract 
Administration Office Functions. Under DFARS, some additional CAO 
functions are identified for the review and evaluation of certain other 
contractor cost estimating and accounting systems. DFARS Subpart 242.3--
Contract Administration Office Functions. 

[33] On a given contract, there may be two types of contracting 
officers: (1) the procuring contracting officer at the buying office, 
who awards and signs the contract, and (2) if assigned by the procuring 
contracting officer after contract award, the ACO at the CAO who 
administers the contract, which includes monitoring contractor 
performance. To facilitate its contract administration work, under its 
decentralized organizational structure, DCMA's divisions have 47 field 
CAOs and assign "corporate" administrative contracting officers to 
provide oversight at larger contractor facilities, such as those 
included in this study. As of December 2008, DCMA has about 10,000 
civilian and military staff overseeing almost 19,000 contractors. 

[34] [hyperlink, http://www.gao.gov/products/GAO-05-341]. 

[35] As part of the rulemaking process, several respondents questioned 
how the contracting officer would verify compliance with the 
requirements. The FAR Council commented that the contracting officer is 
not required to verify compliance, but may inquire at his or her 
discretion as part of contract administrative duties. 72 Fed. Reg. 
65878 (Nov. 23, 2007). 

[36] Under the FAR, however, DCAA's role is advisory, which means it 
has less authority than DCMA's CAOs have to require contractor action 
to correct deficiencies DCMA identifies through contract 
administration. 

[37] According to DCMA headquarters' officials, DCMA's contract 
administrative functions do not address most of DOD's services 
contractors. 

[38] Under FAR 52.203-14--Display of Hotline Poster(s), a contractor is 
exempt from the required display of DOD IG's fraud hotline poster if 
the contractor has an ethics and compliance program that includes a 
reporting mechanism such as a hotline poster. According to the FAR 
Council, unless an agency's inspector general requires specific 
requirements and information for posters, there is no need to have 
multiple agency posters if a company has its own internal reporting 
mechanism. 

[39] DFARS Subpart 203.70--Contractor Standards of Conduct, guidance 
removed by DOD on August 12, 2008. 73 Fed. Reg. 46815 (Aug. 12, 2008). 

[40] Duncan Hunter National Defense Authorization Act for Fiscal Year 
2009, Pub. L. No. 110-417 § 842 (2008). 

[41] Under DOD IG hotline policy, to reduce fear of potential employer 
reprisal and encourage hotline disclosures, the identity of contractor 
employees who report through the DOD hotline is not released without 
employee permission. DOD IG Mission Briefing (Feb. 24, 2009). 

[42] DFARS Subpart 203.9. 

[43] In February 2007, the Under Secretary of Defense for AT&L 
established the Panel on Contracting Integrity, as required by section 
813 of the Defense Authorization Act for Fiscal Year 2007. The panel, 
whose executive director is the Director, Defense Procurement and 
Acquisition Policy and Strategic Sourcing, includes more than 20 senior-
level procurement executives, inspectors general, and other 
representatives from across DOD. As required by the act, DOD has 
submitted two annual reports to Congress since December 2007 on the 
panel's findings and recommendations to foster and monitor contracting 
integrity across the department. John Warner National Defense 
Authorization Act for Fiscal Year 2007, Pub. L. No. 109-364 § 813 
(2006). 

[44] Subsequent to detecting problems through such internal hotlines, 
in accordance with the new FAR rules, contractors are to determine 
whether there is credible evidence that certain contract-related 
violations have occurred. If the contractor determines there is 
credible evidence, the FAR then requires the contractor's timely 
disclosure of violations to the agency inspector general. FAR 52.203- 
13. 

[45] According to senior contract policy officials in the Office of the 
Under Secretary of Defense for AT&L, DOD's Panel on Contracting 
Integrity could take up consideration of this and related matters 
concerning DOD contracting oversight that are affected by FAR changes 
requiring contractor ethics programs. 

[46] The e-supplement, which presents results from the survey of 
contractor ethics programs, can be found on our Web site at [hyperlink, 
http://redesign-www.gao.gov/special.pubs/gao-09-646sp/index.html]. 

[47] Section 848(a) required us to report by January 28, 2009, on the 
internal ethics programs of major defense contractors. Pub. L. No. 110- 
181 § 848 (2008). 

[48] The scope of our review limits our analysis as follows: (1) we 
limited this review to 57 major defense contractors and thus our 
results cannot be generalized as representing all defense contractors' 
internal ethics programs and (2) we limited our review to self-reported 
responses and corroborating documentation from contractors on their 
internal ethics programs, which we did not independently verify for 
implementation or test for effectiveness. 

[49] 73 Fed. Reg. 67064-93 (Nov. 12, 2008). 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: