Avoiding Compliance Violations in Government Contracts
The single most important thing you can do right now is implement an auditable compliance program that ties every contract clause — FAR, DFARS, and agency-specific requirements — to a documented process with a named owner and retrievable evidence. Contractors who do that one thing consistently avoid the vast majority of enforcement actions. Those who don’t often discover the gap during an audit, not before it.
Act within 72 hours if you have an active federal contract:
- Secure and index all contract documents, including modifications, task orders, and incorporated clauses.
- Run a clause gap check: compare every FAR/DFARS clause in your contract against your current written procedures. Flag any clause with no documented process.
- Preserve all billing records, timecards, and cost-support files for the past three years minimum. Do not delete or modify anything.
- Check your SAM.gov registration for accuracy and expiration. An inactive registration can halt payments and trigger responsibility questions.
- Notify counsel immediately if you have identified a potential overbilling, misclassification, or cybersecurity certification gap. The clock on mandatory disclosure under FAR 52.203-13 starts when you know, not when you report.
- Confirm your disclosure threshold: if your contract exceeds $6 million with a performance period of 120 days or more, mandatory written disclosure to the agency OIG is a legal obligation under FAR 52.203-13.
Table of Contents
- Why does compliance matter so much for government contractors?
- What compliance violations do contractors most commonly commit?
- Which FAR clauses and regulations do you actually need to know?
- How do you build a compliance program that holds up under audit?
- What records do you need to keep, and for how long?
- What should you do immediately if you discover a potential violation?
- How do you design training and monitoring that actually demonstrates compliance?
- How Federal-rconstructionsolutions helped a construction contractor reduce compliance risk
- Key Takeaways
- Why culture beats checklists every time
- Federal-rconstructionsolutions’ 5551 Pillar gives contractors a real compliance foundation
- Useful sources for verifying the rules yourself
- FAQ
Why does compliance matter so much for government contractors?
Federal enforcement has expanded significantly in scope and sophistication. Agency audits, OIG investigations, DOJ civil enforcement under the False Claims Act, and contracting officer remedies such as termination and set-aside revocation all represent live risk channels for any contractor with an active federal award. The consequences are not theoretical: they include overpayment recovery, contract termination, suspension from bidding, debarment from all federal work, and personal criminal liability for executives who sign false certifications.
What has changed in 2026 is the breadth of what triggers FCA exposure. DOJ has expanded FCA enforcement theories to include false certifications about cybersecurity controls, DEI representations, and supply chain integrity — not just billing fraud. A contractor who certifies NIST 800-171 compliance in a proposal without actually implementing the required controls has made a legally significant representation that DOJ can pursue as a false claim, even if no financial loss to the government is immediately apparent.
The enforcement pipeline feeds on documentation failures as much as on intentional fraud. Legal analysts note that conclusory or undocumented determinations — responsibility findings, pricing analyses, cost allocations — leave contractors exposed in audits and bid protests. A contracting officer’s file that says “contractor is responsible” without supporting evidence is a liability for the contractor, not a shield.
Key enforcement channels to understand:
- Agency audits (DCAA, OIG): review billing, timekeeping, cost allocations, and cybersecurity certifications.
- DOJ/FCA civil enforcement: targets false certifications, inflated invoices, and misrepresentations in proposals.
- Contracting officer remedies: termination for default, withholding of payments, and referral to the suspending and debarring official (SDO).
- Suspension and debarment: can cut off all federal revenue, often for years, while an investigation proceeds.
- Whistleblower actions (qui tam): employees, subcontractors, and competitors can file FCA suits on the government’s behalf and collect a share of any recovery.
Compliance failures can disqualify bids outright, not just trigger post-award penalties. A responsibility determination that uncovers an unresolved compliance issue can end a bid before award. That downstream revenue loss — future contracts you never win — is often larger than any single penalty.
What compliance violations do contractors most commonly commit?
Most enforcement actions trace back to a handful of recurring failure patterns. Understanding them by name and mechanism is the first step toward preventing them.
The highest-frequency violations in federal construction contracting:
- Charging unallowable costs (FAR Part 31): billing entertainment, lobbying, interest on borrowings, or executive compensation above allowable limits to a government contract. Investigators look for cost categories that FAR Part 31 explicitly excludes, then check whether those costs appear in indirect cost pools allocated to federal work.
- Payroll and Service Contract Act (SCA) misclassification: paying workers below the wage determinations required for their job classification on covered contracts. A laborer classified as an “unskilled helper” to avoid a higher wage rate is a textbook SCA violation that can trigger back-pay liability and FCA exposure.
- Missing or inadequate cybersecurity controls (NIST 800-171/DFARS): certifying that you meet DFARS cybersecurity requirements without implementing the 110 controls specified in NIST SP 800-171. Practitioners confirm that FCA enforcement now reaches these technical failures even when no financial loss is demonstrable.
- Kickbacks and procurement integrity breaches: accepting or offering anything of value to influence a contract award. FAR 52.203-7 requires contractors to prevent, detect, and report kickbacks and to flow those obligations down to subcontractors.
- False certifications in proposals: representing compliance with requirements — small business status, cybersecurity posture, domestic sourcing — that the contractor cannot actually demonstrate. DOJ treats these as FCA violations regardless of whether the underlying work was performed adequately.
- Conflicts of interest and Procurement Integrity Act violations: a contractor employee who receives source selection information, or a former government official who joins a contractor and participates in a procurement they were involved in on the government side, creates exposure under FAR Part 3 and 41 U.S.C. Chapter 21.
- Subcontractor oversight failures: prime contractors are responsible for their subcontractors’ compliance. Failing to flow down required clauses, verify subcontractor SAM registration, or monitor subcontractor billing is a compliance failure at the prime level.
- SAM.gov registration lapses: an expired or inaccurate registration can affect payment eligibility and raise responsibility questions during source selection.
A concrete example: a construction prime bills 200 hours of project management labor to a cost-reimbursable contract. The timecard system is manual and the hours are estimated, not recorded daily. DCAA audits the contract, finds no contemporaneous time records, and disallows the costs. The contracting officer refers the matter to OIG. What started as a recordkeeping shortcut becomes an FCA referral. Common federal bidding mistakes like this one are preventable with the right controls in place before the audit begins.
Mandatory disclosure adds another layer. Under FAR 52.203-13, if your contract exceeds $6 million and runs 120 days or more, written disclosure to the agency OIG is legally required when you have credible evidence of certain violations — including FCA violations and significant overpayments.
Which FAR clauses and regulations do you actually need to know?
Federal contracting compliance is not a single rule. It is a layered framework of FAR clauses, statutes, and technical standards, each with its own trigger conditions and evidence requirements. The table below maps the most critical ones for construction contractors.
| Clause / Standard | When It Applies | Practical Evidence to Retain |
|---|---|---|
| FAR Part 3 (Procurement Integrity) | All federal contracts | Conflict-of-interest screening records, ethics training logs, OCI mitigation plans |
| FAR Part 31 (Cost Principles) | Cost-reimbursable and T&M contracts | Cost allocation methodology, indirect rate calculations, unallowable cost exclusion logs |
| FAR 52.203-7 (Anti-Kickback) | Contracts with subcontractors | Subcontract clause flow-down records, kickback reporting procedures, investigation logs |
| FAR 52.203-13 (Mandatory Disclosure) | Contracts >$6M, ≥120-day performance | Written disclosure records, OIG submission receipts, internal investigation documentation |
| FAR 19.502-2 (Rule of Two) | Acquisitions above micro-purchase threshold | Small business eligibility documentation, NAICS code records, SAM.gov registration |
| False Claims Act | All federal contracts | Certification review records, pre-submission validation checklists, billing approval trails |
| DFARS / NIST SP 800-171 | Contracts involving Controlled Unclassified Information (CUI) | System Security Plan (SSP), Plan of Action & Milestones (POA&M), assessment scores |
| ITAR / EAR (Export Controls) | Contracts involving defense articles or dual-use technology | Export license records, technology control plans, employee screening documentation |
A brief note on each:
- FAR Part 3 sets the baseline standard: government business must be conducted “above reproach.” The Procurement Integrity Act (41 U.S.C. Chapter 21) prohibits disclosure or receipt of source selection information and imposes criminal penalties for violations.
- FAR Part 31 defines which costs the government will and will not reimburse. Unallowable costs charged to a contract — even accidentally — create overpayment liability and FCA exposure.
- The Rule of Two under FAR 19.502-2 requires contracting officers to set aside acquisitions for small businesses when at least two responsible small businesses are expected to submit competitive offers. For contracts below the simplified acquisition threshold, the presumption strongly favors small business set-asides. Contractors must maintain accurate SAM.gov registrations and correct NAICS codes to remain eligible.
- The False Claims Act is the government’s primary civil enforcement tool. It reaches any false statement or certification made in connection with a federal contract, including proposal representations about cybersecurity, domestic sourcing, and small business status.
- NIST SP 800-171 and DFARS 252.204-7012 require contractors handling CUI to implement 110 security controls and report cyber incidents within 72 hours. CMMC (Cybersecurity Maturity Model Certification) adds third-party assessment requirements for certain defense contracts.
- ITAR and EAR apply when a contract involves defense articles, technical data, or dual-use technology. Violations carry criminal penalties and can result in debarment from defense contracting entirely.
For a detailed breakdown of how these clauses apply to construction-specific work, the FAR regulations guide for construction is a useful starting reference.
How do you build a compliance program that holds up under audit?
A compliance program that survives scrutiny is not a binder on a shelf. It is a set of documented processes that connect each contract clause to a specific person, a specific procedure, and retrievable evidence. FAR 52.203-13 has required contractors on covered contracts to maintain a written code of business ethics and conduct since 2008 — but the regulation is explicit that mere possession of the document is insufficient. The program must be operational.
Core components of an audit-ready compliance program:
- Written code of business ethics and conduct: must address conflicts of interest, anti-kickback obligations, mandatory disclosure procedures, whistleblower protections, and document retention rules. Update it annually and distribute it to all employees on covered contracts.
- Designated compliance officer: a named individual with authority, budget, and direct access to leadership. This person owns the clause-to-process mapping and is the point of contact for OIG disclosures.
- Clause-to-process mapping: for every FAR/DFARS clause in your active contracts, document the internal process that satisfies it, who is responsible, and what evidence is generated. This is the single most useful document in an audit.
- Delegated authorities and approval workflows: define who can approve invoices, timecards, subcontract awards, and cost allocations. Timestamped approvals create an audit trail that investigators can follow.
- Procurement and subcontractor vetting: verify SAM.gov registration, check for debarment, confirm NAICS eligibility, and flow down required clauses before issuing any subcontract.
- Payroll and timekeeping controls: require contemporaneous daily time recording. Manual, estimated, or reconstructed timecards are a primary audit flag.
- Cost accounting alignment to FAR Part 31: maintain a written cost accounting policy that identifies unallowable cost categories and documents how they are excluded from government billing.
- Cybersecurity mapping to NIST SP 800-171: maintain a current System Security Plan and Plan of Action & Milestones. Assess your implementation score honestly — an inflated self-assessment is FCA exposure.
- Export control screening: if your contract involves technical data or defense articles, implement a technology control plan and screen employees and subcontractors against restricted party lists.
- Training program: cover ethics, anti-kickback, procurement integrity, cyber hygiene, and timekeeping. Document attendance and test completion for every employee on a covered contract.
Minimum policy content for audit-readiness:
Your written policies must specify disclosure procedures (who reports, to whom, and within what timeframe), whistleblower protections (no retaliation for good-faith reporting), document retention rules (minimum periods by record type), and the consequences for policy violations. Vague policies that say “we comply with all applicable laws” provide no protection.
Operationalizing compliance across departments means finance owns cost accounting and invoice review, HR owns timekeeping and labor classification, IT owns the System Security Plan and incident reporting, and operations owns subcontractor clause flow-downs and site-level controls. Each function generates evidence; the compliance officer collects and indexes it.
Pro Tip: Use automated approval workflows in your contract management system to generate timestamped, user-attributed approval records for every invoice and timecard. Investigators reviewing a DCAA audit can pull a complete approval chain in minutes — and that speed of retrieval, combined with clean records, often prevents an audit from escalating to an investigation.
The federal procurement compliance checklist from Federal-rconstructionsolutions provides a practical starting template you can adapt to your contract portfolio.
What records do you need to keep, and for how long?
Investigators will request specific categories of documents, and how quickly you can produce them materially affects enforcement outcomes. Contract management systems with centralized storage, version history, structured approval workflows, and timestamped audit trails reduce documentation gaps and improve retrieval speed. Manual filing systems create the opposite: gaps that look like concealment even when they are just disorganization.
Documents to maintain for every covered contract:
- Invoices and billing support (labor hours, material receipts, subcontractor invoices)
- Contemporaneous timecards and timesheet approval records
- Cost allocation workpapers and indirect rate calculations
- Subcontractor awards, clause flow-down confirmation, and payment records
- Pricing support and certified cost or pricing data (if applicable)
- Responsibility determinations and SAM.gov verification records
- Proposal certifications and pre-submission validation checklists
- Cybersecurity assessment records (SSP, POA&M, incident reports)
- Ethics training attendance logs and acknowledgment forms
- Internal audit reports and remediation records
| Record Type | Retention Period | Storage Format |
|---|---|---|
| Invoices and billing support | 3 years after final payment | Electronic, indexed by contract number |
| Timecards and payroll records | 3 years (SCA: 3 years minimum) | Electronic with original signatures or biometric timestamps |
| Subcontractor records | 3 years after contract closeout | Electronic, with clause flow-down confirmation |
| Certified cost or pricing data | 3 years after final payment | Electronic, with version history |
| Cybersecurity records (SSP, POA&M) | Duration of contract + 3 years | Secure electronic system, access-controlled |
| Ethics training records | Duration of contract + 3 years | Electronic, searchable by employee and date |
| Internal audit reports | 3 years after report date | Electronic, with remediation status tracking |
Practical retrieval means indexing every document by contract number, clause reference, and date. When an auditor requests “all timecards for Contract No. W912XX-24-C-0001 from January through June 2025,” you should be able to produce them within hours, not days. Agencies increasingly use analytics to flag anomalies in contractor reporting — indirect cost misallocations, mismatched labor hours, unsupported cost categories — and contractors relying on manual records are at higher detection risk. Automated reconciliation between your timekeeping system and your billing system eliminates the most common flags before they appear in an audit report.
A note on audit timelines: DCAA audits can open months or years after contract performance. Retention periods are minimums, not targets. For contracts with ongoing disputes or OIG referrals, retain everything until the matter is formally closed.
What should you do immediately if you discover a potential violation?
Speed and sequence matter. The steps you take in the first 48–72 hours after discovering a potential violation determine whether you control the narrative or investigators do.
- Stop the activity. If the potential violation involves ongoing billing, cost allocation, or a certification that may be false, suspend that specific activity immediately. Do not wait for legal confirmation to stop.
- Preserve all evidence. Issue a litigation hold to everyone who might have relevant documents — email, timecards, invoices, system logs. Instruct them not to delete, modify, or discuss the matter outside the investigation team. Document the hold in writing.
- Notify legal counsel. Engage counsel with federal contracting experience before taking any further steps. Attorney-client privilege protects the investigation if structured correctly from the start.
- Scope the internal investigation. With counsel, define the time period, contract scope, and personnel involved. Assign an independent investigator — not the person whose conduct is in question.
- Suspend implicated personnel from relevant duties pending investigation. This is a mitigation factor in debarment reviews and demonstrates that the organization took the matter seriously.
- Document remediation steps in real time. Every corrective action — process change, personnel action, system fix — should be documented with a date, responsible party, and evidence of completion.
- Assess mandatory disclosure obligations. If the contract exceeds $6 million with a performance period of 120 days or more, FAR 52.203-13 requires written disclosure to the agency OIG when you have credible evidence of certain violations. Counsel must evaluate whether the disclosure threshold is met.
- Evaluate voluntary self-disclosure to DOJ. Under the DOJ Corporate Enforcement and Voluntary Self-Disclosure Policy, a company that voluntarily self-discloses, fully cooperates, and timely remediates can receive a presumption of declination — meaning DOJ presumes it will not prosecute — absent aggravating circumstances. That is a significant benefit worth evaluating with counsel.
- Prepare the disclosure package. If disclosure is required or elected, the package should include a factual summary, the scope of the violation, remediation steps taken, and a point of contact for follow-up. Incomplete or misleading disclosures are worse than no disclosure.
- Cooperate fully with any government investigation. Obstruction, document destruction, or misleading investigators converts a civil matter into a criminal one. Cooperation is both a legal obligation and a mitigation factor.
When to disclose vs. when to fix internally: The mandatory disclosure clause under FAR 52.203-13 sets a legal floor — you must disclose credible evidence of fraud, FCA violations, and significant overpayments on covered contracts. Below that threshold, or for violations that do not meet the “credible evidence” standard, voluntary disclosure to DOJ may still be strategically beneficial if the violation is material and likely to be discovered. Counsel must make that call based on the specific facts.
Remediation and cooperation directly affect suspension and debarment outcomes. A suspending and debarring official (SDO) evaluating “present responsibility” will consider whether the contractor identified the problem, fixed it, disciplined responsible parties, and implemented controls to prevent recurrence. A defensible compliance posture requires documented investigations, remediation records, and proof of timely corrective action — not just a policy that says the right things.
How do you design training and monitoring that actually demonstrates compliance?
Training that produces no evidence is training that did not happen, from an investigator’s perspective. The goal is not just to educate employees — it is to generate a documented record that your program is active, your people understand their obligations, and you catch problems before the government does.
Essential training topics and recommended frequency:
- Ethics and code of conduct: annually for all employees on covered contracts; upon hire for new employees.
- Anti-kickback and procurement integrity: annually for procurement, finance, and business development staff; upon contract award for project managers.
- Timekeeping and labor charging: at onboarding and annually; mandatory for all employees who charge time to federal contracts.
- Cyber hygiene and incident reporting: quarterly awareness training; annual deep-dive for IT and anyone handling CUI.
- FAR cost principles (Part 31): annually for finance and accounting staff; upon assignment for project controllers.
- Export control (ITAR/EAR): upon hire and annually for employees working on defense-related contracts.
Document every session: date, instructor, attendees, topics covered, and test scores where applicable. Acknowledgment forms signed by each employee create individual accountability.
Monitoring activities that generate usable evidence:
- Internal audits of billing and timekeeping, conducted quarterly on high-risk contracts.
- Subcontractor spot checks: verify SAM.gov status, confirm clause flow-down, and review invoices against deliverables.
- Timecard reconciliation: compare hours charged to federal contracts against project schedules and deliverable milestones.
- Cybersecurity control checks: quarterly review of SSP implementation status and POA&M progress.
- Contract clause compliance reviews: at contract award, at each modification, and annually for long-term contracts.
Third-party site audits can supplement internal monitoring for on-site compliance, particularly for subcontractor oversight and site-level documentation.
Sample KPIs to track and report to leadership:
- Percentage of active contracts with completed clause-to-process mapping (target: 100%).
- Time to retrieve a requested document set in response to an audit request (target: under 4 business hours).
- Number of internal audit findings remediated within the defined SLA (target: 95% within 30 days).
- Percentage of employees on covered contracts with current training completion (target: 100%).
- Number of subcontractor SAM.gov verifications completed before subcontract award (target: 100%).
Monitoring data serves a dual purpose. It improves your program in real time, and it becomes evidence in enforcement proceedings. An SDO evaluating present responsibility will ask whether the contractor’s compliance program was active and effective. KPI reports, audit logs, and remediation records answer that question with facts, not assertions. FAR 52.203-13 explicitly requires contractors to take steps to foster a culture of active compliance — and documented monitoring is how you prove that culture exists.
How Federal-rconstructionsolutions helped a construction contractor reduce compliance risk
A mid-size construction contractor pursuing federal work faced a common set of pressures: active cost-reimbursable contracts with DCAA audit exposure, subcontractor invoices that lacked adequate billing support, a cybersecurity posture that had not been formally assessed against NIST SP 800-171, and no designated compliance officer. The company had a general ethics policy but no clause-to-process mapping and no training records for the prior contract year.
Federal-rconstructionsolutions’ 5551 Pillar engaged with the contractor to address each gap systematically. The team conducted a full clause audit across active contracts, mapping every FAR and DFARS clause to a responsible owner and a documented process. Subcontractor management procedures were restructured to require SAM.gov verification, clause flow-down confirmation, and invoice-level billing support before payment approval. A System Security Plan was developed and a POA&M established for outstanding NIST 800-171 controls. A designated compliance officer was placed, and a training calendar was implemented covering ethics, timekeeping, anti-kickback, and cyber hygiene.
Outcomes from the 5551 Pillar engagement:
- Compliance rate on bid submissions reached 90%, reducing the risk of responsibility-based disqualifications.
- Audit response time for document requests dropped from days to hours, following centralized indexing and electronic storage implementation.
- Subcontractor clause flow-down compliance reached 100% on new awards within the first contract cycle.
- The contractor successfully secured a public water infrastructure contract, with the compliance program cited as a positive responsibility factor during source selection.
The 5551 Pillar approach works because it treats compliance as an operational system, not a documentation exercise. Every control generates evidence. Every process has an owner. And when an auditor or contracting officer asks a question, the answer is retrievable in minutes.
Key Takeaways
An auditable, clause-mapped compliance program is the single most effective protection against government contract enforcement actions, debarment, and False Claims Act liability.
| Point | Details |
|---|---|
| Implement clause-to-process mapping | Link every FAR/DFARS clause in your contracts to a named owner and retrievable evidence before an audit opens. |
| Know your mandatory disclosure threshold | Contracts exceeding the applicable statutory thresholds require written OIG disclosure of credible violations under FAR 52.203-13. |
| Treat certifications as legal representations | DOJ now pursues false cybersecurity, DEI, and supply chain certifications under the False Claims Act, even without demonstrable financial loss. |
| Document monitoring and training | Timestamped training records, audit logs, and KPI reports are the evidence an SDO reviews when evaluating present responsibility during debarment proceedings. |
| Federal-rconstructionsolutions 5551 Pillar | Provides clause mapping, audit-ready documentation, training programs, and compliance officer placement for construction contractors pursuing federal work. |
Why culture beats checklists every time
The contractors who avoid the most serious enforcement outcomes are not necessarily the ones with the thickest compliance binders. They are the ones where a project manager actually stops a billing entry because it does not look right, where a subcontractor coordinator checks SAM.gov before issuing a purchase order without being told to, and where the compliance officer has a direct line to the CEO and uses it.
What tends to happen in companies that rely on checkbox compliance is that the policies exist but the incentives do not align with them. Billing supervisors are rewarded for speed, not accuracy. Project managers are measured on schedule, not clause adherence. The compliance officer is buried in the org chart and consulted only when something has already gone wrong. That structure produces violations, not because people are dishonest, but because the system rewards the wrong behaviors.
The regulatory framework itself reflects this understanding. FAR 52.203-13 does not just require a written code — it requires contractors to “take steps to foster a culture of active compliance.” That language is deliberate. Investigators and SDOs are trained to look past the policy document and ask whether the culture supports it. Documented investigations, disciplinary actions, and remediation records are the evidence that answers that question. Governance plus documentation plus aligned incentives is the combination that actually protects a contractor when enforcement comes.
The contractors who thrive long-term in federal work are the ones who treat compliance as a business function with the same rigor as finance or operations — not as a legal obligation to be minimized. That shift in framing changes everything about how a program is built and maintained.
Federal-rconstructionsolutions’ 5551 Pillar gives contractors a real compliance foundation
Compliance management in government contracts does not have to mean hiring a full internal legal team or navigating FAR clauses alone. Federal-rconstructionsolutions’ 5551 Pillar is built specifically for construction businesses that need a practical, audit-ready compliance program without the overhead of building one from scratch.
The 5551 Pillar service operationalizes what this guide describes: clause-to-process mapping across your active contracts, documentation systems that produce retrievable evidence, training programs tailored to your workforce, SAM.gov registration support, and subcontractor oversight procedures that hold up under DCAA review. For contractors working on USACE projects, USACE-specific procurement support addresses the additional compliance requirements those contracts carry.
What the 5551 Pillar delivers:
- Full clause audit and gap analysis across your contract portfolio.
- Written compliance program development, including code of conduct and disclosure procedures.
- Compliance officer placement and training calendar implementation.
- Audit-ready documentation and centralized record management.
- Subcontractor vetting and clause flow-down verification.
- Cybersecurity posture assessment against NIST SP 800-171.
The next step is a compliance assessment. Federal-rconstructionsolutions reviews your active contracts, identifies your highest-risk gaps, and delivers a prioritized remediation plan. Schedule your assessment at federal-rconstructionsolutions.com/dot-gov and know exactly where you stand before an auditor does.
Useful sources for verifying the rules yourself
Every contractor should bookmark these primary sources and consult them directly when a clause question arises. Counsel should always be involved for legal interpretation, but knowing where to find the authoritative text puts you ahead of most.
- FAR 52.203-13 — Contractor Code of Business Ethics and Conduct: the mandatory disclosure clause, code requirements, and OIG reporting obligations. Consult this for any question about when and how to disclose.
- FAR 52.203-7 — Anti-Kickback Procedures: defines kickback, prescribes prevention and reporting procedures, and covers subcontract flow-down requirements.
- FAR Part 3 — Improper Business Practices and Personal Conflicts of Interest: the full Procurement Integrity Act implementation, gratuities clause, and conflict-of-interest policies.
- FAR 19.502-2 — Set-asides for small business (Rule of Two): the regulatory Rule of Two, set-aside thresholds, and socioeconomic program priority order.
- Congress.gov — Rule of Two overview: Congressional Research Service summary of statutory and regulatory Rule of Two requirements, including the proposed 2024 expansion to task and delivery orders.
- DOJ — False Claims Act: the statute, enforcement priorities, and qui tam provisions. Read this to understand what DOJ can pursue and how.
- Jessica Tillipman — U.S. Federal Procurement Anti-Corruption Ecosystem: practitioner-level analysis of the enforcement ecosystem, voluntary disclosure policy, and debarment mitigation strategies.
- K&L Gates — Expanding False Claims Act enforcement: detailed analysis of DOJ’s expanded FCA theories covering cybersecurity, DEI, and supply chain certifications.
- Acquisition.gov — FAR Browse Index: the full FAR, searchable by part and clause number. Use this to pull the exact text of any clause incorporated into your contract.
- On-site compliance checklists for contractors: a practical operational reference for site-level compliance documentation and process verification.
Retain a printed or PDF copy of every clause incorporated into your contract at the time of award. Clauses can be updated between contract award and audit, and having the version that applied to your performance period is essential for your defense.
This article is general information for educational purposes. It is not legal advice. Consult a qualified federal contracting attorney for guidance specific to your contracts and situation.
FAQ
What is the Rule of Two in government contracting?
The Rule of Two requires contracting officers to set aside acquisitions for small businesses when at least two responsible small businesses are expected to submit competitive offers at fair market prices. For contracts below the simplified acquisition threshold, the presumption strongly favors small business set-asides by statute.
How do you prevent corruption in public procurement?
Preventing corruption requires a written code of conduct, conflict-of-interest screening, anti-kickback training, and a confidential reporting channel for employees. FAR Part 3 sets the baseline standard: government business must be conducted with complete impartiality and above reproach, with no preferential treatment.
How do you ensure contract compliance in federal work?
Compliance requires mapping every FAR/DFARS clause in your contract to a documented internal process, a named responsible party, and retrievable evidence. Regular internal audits, contemporaneous timekeeping, and a designated compliance officer are the operational controls that make that mapping real rather than theoretical.
What is prohibited under the Procurement Integrity Act?
The Procurement Integrity Act (41 U.S.C. Chapter 21), implemented through FAR Part 3, prohibits the disclosure or receipt of contractor bid or proposal information and source selection information. Violations can result in criminal penalties, contract rescission, and referral to the suspending and debarring official.
When does a contractor have to self-disclose a violation to the government?
Under FAR 52.203-13, contractors with contracts exceeding $6 million and performance periods of 120 days or more must disclose credible evidence of fraud, False Claims Act violations, and significant overpayments in writing to the agency OIG. Voluntary self-disclosure to DOJ on other matters can result in a presumption of declination under the DOJ Corporate Enforcement and Voluntary Self-Disclosure Policy.
