Contractor Code of Business Ethics and Conduct

Laura K. Kennedy Senior Vice President, Ethics and Compliance SAIC

Origin of FAR Clause on Business Ethics and Compliance

FAR Clause on Contractor Code of Business Ethics and Conduct (52.203-13)
Requires government contractors to: Exercise due diligence to prevent and detect criminal conduct Promote an organizational culture that encourages ethics and compliance Submit mandatory disclosures to the government

DCAA Audit Guidance

Audits compliance with each specific element of the FAR clause.

1991

2004 2008 2009

2010

U.S. Sentencing Guidelines

Companies can reduce sentences if have effective compliance and ethics programs.

Revised U.S. Sentencing Guidelines

Effective compliance and ethics programs: Exercise due diligence to prevent and detect criminal conduct Promote an organizational culture that encourages ethical conduct and commitment to compliance

Amendments to U.S. Sentencing Guidelines:

Companies can reduce sentences if: Chief Compliance Officer has direct reporting obligations to governing authority (i.e. Board) Company detects offense before discovery outside, and promptly reports offense to government Compliance and ethics personnel did not participate in, condone, or were willfully ignorant of offense.

Energy | Environment | National Security | Health | Critical Infrastructure

2009 SAIC. All rights reserved. SAIC, the SAIC logo, and From Science to Solutions are registered trademarks of Science Applications International Corporation in the United States and/or other countries.

Sections of the FAR 52.203-13 Definitions Code of Business Ethics and Conduct Business Ethics Awareness and Compliance Program and Internal Control System Subcontracts
4
Energy | Environment | National Security | Health | Critical Infrastructure

Key Definitions

Full Cooperation:
Disclosure to the Government of information sufficient for law enforcement to identify nature and extent of offense and individuals responsible for conduct. Not require waiver of attorney-client or work product privileges or Fifth Amendment rights

Principal:
Officer, director, owner, partner or person having primary management or supervisory responsibilities within a business entity Examples: general manager, plant manager, head of subsidiary, division or business segment

Subcontract:
Contract entered into by subcontractor to furnish supplies or services for performance of a prime contract or subcontract. Subcontractor is a supplier, distributor, vendor or firm that furnished supplies or services to or for a prime contractor

5
Energy | Environment | National Security | Health | Critical Infrastructure

Code of Business Ethics and Conduct

1. Within 30 days after contract award, contractor shall:

Have written code of business ethics and conduct Make a copy available to each employee engaged in contract performance 2. Contractor shall: Exercise due diligence to prevent and detect criminal conduct Promote an organizational culture that encourages ethical conduct and a commitment to compliance with law. 3. Contractor shall timely disclose in writing to agency Inspector General whenever in connection with the award, performance or closeout of the contract or subcontract, Contractor has credible evidence that a principal, employee, agent or subcontractor has committed certain violations of law.

Energy | Environment | National Security | Health | Critical Infrastructure

2009 SAIC. All rights reserved. SAIC, the SAIC logo, and From Science to Solutions are registered trademarks of Science Applications International Corporation in the United States and/or other countries.

Business Ethics Awareness and Compliance Program and Internal Control System
Provision does not apply to small businesses or commercial item contracts Within 90 days of contract award, Contractor shall establish: 1. Ongoing ethics awareness and compliance program Reasonable steps to communicate periodically and in practical manner Contractors standards and procedures by conducting effective training programs and otherwise disseminating information appropriate to individuals respective roles and responsibilities Training for contractors principals and employees and, as appropriate, contractors agents and subcontractors. 2. Internal Control System Establish standards and procedures to facilitate timely discovery of improper conduct in connection with Government contracts Ensure corrective measures are promptly instituted and carried out.
7 Energy | Environment | National Security | Health | Critical Infrastructure

2009 SAIC. All rights reserved. SAIC, the SAIC logo, and From Science to Solutions are registered trademarks of Science Applications International Corporation in the United States and/or other countries.

Internal Control System: Minimum Requirements

1. Assignment of responsibility at sufficiently high level and adequate resources to ensure effectiveness of program 2. Reasonable efforts not to include individual as a principal, whom due diligence would have exposed conduct in conflict with Code 3. Periodic reviews of business practices, procedures and internal controls (slide 8) 4. Internal reporting mechanism, such as hotlines, to report suspected misconduct and instructions that encourage employees to make reports 5. Disciplinary actions for improper conduct or failing to take reasonable steps to prevent or detect improper conduct 6. Timely Disclosure to the agency Inspector General of certain violations of law 7. Full Cooperation with Government agencies for audits, investigations and actions
8 Energy | Environment | National Security | Health | Critical Infrastructure
2009 SAIC. All rights reserved. SAIC, the SAIC logo, and From Science to Solutions are registered trademarks of Science Applications International Corporation in the United States and/or other countries.

Periodic Reviews of Business Practices, Procedures and Internal Controls for Compliance

1. Monitoring and auditing to detect criminal conduct 2. Periodic evaluation of effectiveness of business ethics awareness and compliance program and internal control system 3. Periodic assessment of the risk of criminal conduct
Appropriate steps to design, implement or modify business

awareness and compliance program and internal control system as necessary to reduce risk of identified criminal conduct.

Energy | Environment | National Security | Health | Critical Infrastructure

2009 SAIC. All rights reserved. SAIC, the SAIC logo, and From Science to Solutions are registered trademarks of Science Applications International Corporation in the United States and/or other countries.

Subcontracts

Contractor shall include the substance of the clause in contracts over $5 million and a performance period of more than 120 days. Disclosures of violations of the civil False Claims Act or Federal criminal law shall be directed to the agency Inspector General, with a copy to the Contracting Officer.

10

Energy | Environment | National Security | Health | Critical Infrastructure

Business Ethics Awareness and Compliance Program

Specified Requirements
Communications and Training

Sample Practices
Ethics Training; Targeted Compliance Training; Quarterly Newsletters and Communications Tools; Ethics and Compliance Website Robust system of reporting suspected misconduct; procedures to ensure independent, expert and timely investigation of alleged misconduct; valid cases require corrective measures, including remedial and disciplinary actions Dedicated Ethics & Compliance Staff with senior leader reporting to executive management and the Board of Directors; Employee Ethics Committee representing each business and key corporate function Screening Procedures to identify broad range of categories of potential wrongdoing; Maintain database of misconduct Ethics Review Board; Ethics Surveys; Benchmarking; Focus Groups; Case Trend Analyses Tracking of Key Risk Areas and Implementation of Controls; Continual process improvements based on case data 8 Alternative Disclosure Channels with procedures for anonymous and confidential reporting; Code of Conduct encourages or requires reporting of observed misconduct Policy statement to discipline misconduct; HR Tracking of disciplinary actions to establish consistency; Reporting disciplinary actions to senior management and Board of Directors
Energy | Environment | National Security | Health | Critical Infrastructure

Procedures to Facilitate Timely Discovery of Improper Conduct and Ensure Corrective Actions

High-Level Personnel to Oversee Program

Efforts Not to Include as Principals Individuals Engaged in Misconduct Monitoring, Auditing and Evaluating Program Effectiveness

Periodic Risk Assessments and Remedial Action System for Internal Reporting of Suspected Misconduct

Disciplinary Action for Improper Conduct

11

Appendix

Energy | Environment | National Security | Health | Critical Infrastructure

12

FAR 52.203-13: Contractor Code of Business Ethics and Conduct - Template

PRIMARY REQUIREMENT Written Code Available to All Employees n/a Due Diligence to Prevent/Detect Criminal Conduct n/a SECONDARY TERTIARY PROGRAM IN PLACE? METHOD TO ADDRESS

n/a

n/a

Promote Org Culture that Encourages Ethical Conduct/Commitment to Compliance with the Law

n/a

n/a

Written Disclosures to OIG When Violations of Federal Criminal Law or Civil False Claims Act are Identified Ongoing Ethics & Compliance Program

n/a

n/a

Periodic communication of standards/procedures n/a

13

Energy | Environment | National Security | Health | Critical Infrastructure

FAR 52.203-13: Contractor Code of Business Ethics and Conduct - Template

PRIMARY REQUIREMENT SECONDARY Effective training program on roles and responsibilities TERTIARY PROGRAM IN PLACE? METHOD TO ADDRESS

n/a

Internal Control System Establishes standards/procedures to facilitate timely discovery of improper conduct

n/a

Ensures corrective measures are promptly instituted and carried out

n/a

Assigns responsibility at a sufficiently high level, ensures sufficient resources to ensure effectiveness of E&C program and internal control system Reasonable effort not to include principals whom due diligence would have exposed as having engaged in improper conduct

n/a

n/a

14

Energy | Environment | National Security | Health | Critical Infrastructure

FAR 52.203-13: Contractor Code of Business Ethics and Conduct - Template

PRIMARY REQUIREMENT SECONDARY Periodic review of business practices, procedures, policies, and internal controls for compliance with Code and regulations specific to Govt contractors TERTIARY PROGRAM IN PLACE? METHOD TO ADDRESS

Monitoring/auditing to detect criminal misconduct Evaluating E&C and internal control system effectiveness Assessing risk of criminal conduct with appropriate steps to design, implement, or modify existing E&C or internal control programs as necessary to reduce risk Internal reporting mechanism allowing for anonymous or confidential employee reports of misconduct, and instructions that encourage employees to report Disciplinary action for improper conduct or for failing to take reasonable steps to prevent/detect improper conduct Timely disclosure of violations to OIG n/a Fully cooperates with any Government agencies responsible for audits, investigations, or corrective actions.

n/a

n/a

n/a

15

Energy | Environment | National Security | Health | Critical Infrastructure