Contractor Ethics and Mandatory Disclosure for Software Companies: What FAR 52.203-13 Requires

Most software companies meet the federal ethics rules for the first time as a line in a contract they have already signed. FAR 52.203-13 shows up in the clause list, someone in legal notes that the company needs a written code of conduct, and the matter goes quiet. The part that matters most, the duty to report wrongdoing to the government, is easy to miss until the day it applies.

This guide covers the Contractor Code of Business Ethics and Conduct clause, FAR 52.203-13, and the related rules in FAR subpart 3.10 and FAR 9.4: which contracts carry it, what the code and compliance program must include, what triggers a mandatory disclosure, and why disclosure is usually the better outcome for the company. It is written for founders, finance leads and the people who own compliance at a software company, and it builds on our guides to suspension and debarment and the Procurement Integrity Act.

---

Which contracts carry the clause

FAR 3.1004 tells contracting officers to insert FAR 52.203-13 in solicitations and contracts when two conditions hold:

• the contract value is expected to exceed the dollar threshold set in that section, and
• the performance period is 120 days or more.

The threshold is adjusted for inflation, so read the current figure in the FAR rather than an old blog post. Most multi-year enterprise software, SaaS and IT services contracts of any size clear both tests.

The clause also flows down. Paragraph (d) requires the prime to include its substance in subcontracts above the same threshold with a performance period of more than 120 days. If you sell through a reseller or as a subcontractor to an integrator, expect to see it in your subcontract. Our guide to flow-down clauses covers how that works.

Even when the clause is not in a contract, FAR 3.1002 states the policy behind it: government contractors must conduct themselves with the highest degree of integrity and honesty, should have a written code of business ethics and conduct, and should have an employee ethics and compliance training program and internal control system suited to the size of the company and the extent of its government business.

---

What the clause requires

The written code (every covered contractor)

Under paragraph (b)(1), within 30 days after contract award, unless the contracting officer sets a longer period, the contractor shall:

• have a written code of business ethics and conduct, and
• make a copy of the code available to each employee engaged in performance of the contract.

Paragraph (b)(2) adds two standing duties. The contractor shall exercise due diligence to prevent and detect criminal conduct, and otherwise promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law.

The compliance program and internal controls (larger companies, non-commercial contracts)

Paragraph (c) goes further, but it does not apply if the contractor is a small business concern or the contract is for the acquisition of a commercial product or commercial service. For everyone else, within 90 days after award, the contractor shall establish:

• an ongoing business ethics awareness and compliance program, including reasonable steps to communicate its standards and procedures through effective training programs for principals and employees, and as appropriate, agents and subcontractors, and
• an internal control system that facilitates timely discovery of improper conduct in connection with government contracts and ensures corrective measures are promptly carried out.

The clause lists what the internal control system must provide for at a minimum, including:

• assignment of responsibility at a sufficiently high level, with adequate resources, for the program,
• reasonable efforts not to include people as principals whom due diligence would have shown engaged in conduct in conflict with the code,
• periodic reviews of business practices, procedures, policies and internal controls,
• an internal reporting mechanism, such as a hotline, that allows for anonymity or confidentiality,
• disciplinary action for improper conduct or for failing to take reasonable steps to prevent or detect it,
• timely disclosure of the violations described below, and
• full cooperation with government agencies responsible for audits, investigations or corrective actions.

A separate clause, FAR 52.203-14, can also require covered contractors to display agency fraud hotline posters. Check your contract for it.

Since most early-stage software companies are small businesses, and much federal software is bought as a commercial product, many will only owe the code and the disclosure duty. That is the floor, not the ceiling. A buyer weighing a vendor for a sensitive system will still ask how the company handles a compliance problem.

---

The mandatory disclosure duty

Paragraph (b)(3) is the core of the clause. The contractor shall timely disclose, in writing, to the agency Office of Inspector General, with a copy to the contracting officer, whenever, in connection with the award, performance or closeout of the contract or any subcontract under it, the contractor has credible evidence that a principal, employee, agent or subcontractor of the contractor has committed:

• a violation of federal criminal law involving fraud, conflict of interest, bribery or gratuity violations found in Title 18 of the United States Code, or
• a violation of the civil False Claims Act, 31 U.S.C. 3729-3733.

If the violation relates to an order against a governmentwide acquisition contract, a multi-agency contract, a multiple-award schedule contract such as a GSA schedule, or any other contract intended for use by multiple agencies, the contractor notifies the Office of Inspector General of the ordering agency and the inspector general of the agency responsible for the basic contract.

Three terms do most of the work.

Credible evidence. The rule does not require a disclosure on the first rumor. The FAR Council’s explanation of the rule says a contractor may take time to make a preliminary examination of the evidence to decide whether it is credible before it must disclose. It does not allow a company to sit on evidence until a full investigation is finished.

Principal. FAR 2.101 defines a principal as an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity, such as a general manager, plant manager, or head of a division or business segment. It is broader than the C-suite.

Full cooperation. The clause defines it as disclosing information sufficient for law enforcement to identify the nature and extent of the offense and the individuals responsible, and giving timely and complete responses to government auditors’ and investigators’ requests for documents and access to employees with information. It does not require the contractor to waive attorney-client privilege or work product protection, and it does not stop the contractor from conducting an internal investigation or defending itself.

Information a contractor marks confidential or proprietary in a disclosure is safeguarded to the extent permitted by law and regulation, and the government will not release it under a Freedom of Information Act request without prior notification to the contractor.

---

The duty that applies to every contract

The clause is only part of the picture. FAR 9.406-2(b)(1)(vi) makes it a cause for debarment, and FAR 9.407-2(a)(8) a cause for suspension, when a principal knowingly fails to timely disclose to the government, until three years after final payment on any government contract awarded to the contractor, credible evidence of:

• a violation of federal criminal law involving fraud, conflict of interest, bribery or gratuity violations found in Title 18,
• a violation of the civil False Claims Act, or
• significant overpayments on the contract, other than overpayments resulting from contract financing payments.

This cause does not depend on FAR 52.203-13 being in the contract. It reaches small businesses, commercial contracts and contracts below the clause threshold alike. Separately, the payment clauses in most contracts require a contractor that learns of a duplicate payment or other overpayment to notify the contracting officer and return the money. Our guide to federal invoicing and prompt payment covers how billing works on the government side.

---

Where software companies run into it

The rules were written with large defense primes in mind, but the fact patterns that trigger them are ordinary in software sales:

• Billing and licensing. Charging for more seats, users or consumption than the government received, or billing a renewal the agency did not exercise, can become an overpayment, and a knowing overcharge can become a False Claims Act issue.
• Pricing disclosures. Misstating commercial sales practices or discounts on a GSA schedule offer can lead to price reduction claims and worse. Our guide to GSA schedule pricing covers what you represent.
• Representations and certifications. Size status, country of origin and cybersecurity representations are statements to the government. Our guides to representations and certifications and the Trade Agreements Act cover two of the most common.
• Security attestations. The Department of Justice announced its Civil Cyber-Fraud Initiative in October 2021 to use the False Claims Act against contractors that knowingly misrepresent their cybersecurity practices or fail to report incidents as required. Aerojet Rocketdyne agreed to pay $9 million in 2022 to resolve allegations brought under it. A self-attested security claim is still a claim to the government, and our guide to secure software attestation covers the form your CEO may be asked to sign.
• Gifts and hiring. Gratuities to government staff and job talks with officials on your procurements fall under the conflict of interest and bribery laws. The Procurement Integrity Act guide covers the hiring rules.

---

Why disclosure is usually the better outcome

Disclosure feels like inviting trouble. The FAR treats it the other way around.

Suspension and debarment are not punishment under FAR 9.402. They exist to protect the government from contractors that are not presently responsible. When an official decides whether to debar, FAR 9.406-1(a) lists mitigating factors to weigh, including whether the contractor:

• had effective standards of conduct and internal control systems in place at the time of the activity,
• brought the activity to the attention of the government in a timely manner,
• fully investigated the circumstances and made the results available to the debarring official,
• cooperated fully with government agencies during the investigation,
• paid or agreed to pay all criminal, civil and administrative liability, including investigative costs, and made restitution,
• took appropriate disciplinary action against the individuals responsible, and
• put remedial measures and new or revised review and control procedures in place.

A company that discloses, cooperates and fixes the problem has most of that list in hand. A company that stays quiet turns one problem into two, because the failure to disclose is itself a cause for exclusion. Our guide to responsibility determinations covers how contracting officers read a company’s integrity record before award.

---

A compliance checklist for software companies

• Find the clause. Search every prime contract and subcontract for FAR 52.203-13 and FAR 52.203-14, and note whether paragraph (c) applies to you.
• Write the code before award. Thirty days is short. Have a written code of business ethics and conduct ready, and a way to show each employee on the contract received it.
• Give people a way to report. Even a small company can run an internal reporting channel that allows anonymity or confidentiality.
• Name an owner. Decide who evaluates a report, who calls outside counsel, and who signs a disclosure.
• Reconcile billing against delivery. Seat counts, consumption and renewals are where most overpayments start. Check them before each invoice, not at closeout.
• Treat attestations as evidence. Do not sign a security, size or origin representation you cannot support with records. Self-attested is not the same as verified, and the government knows the difference.
• Train the sales team. Gifts, meals and job talks with government staff have rules, and the people closing deals need to know them.
• Read the current rule text. The FAR is being rewritten under the Revolutionary FAR Overhaul, so section numbers and wording may move. Confirm the clauses in your contract and get advice from counsel on specific situations.

---

The short version

• FAR 52.203-13 goes in contracts above a dollar threshold with a performance period of 120 days or more, and it flows down to larger subcontracts.
• Every covered contractor needs a written code within 30 days of award. Companies that are not small businesses, on non-commercial contracts, also need a compliance program and internal controls within 90 days.
• The clause requires timely written disclosure to the agency inspector general of credible evidence of Title 18 fraud, conflict of interest, bribery or gratuity violations, or civil False Claims Act violations.
• Failing to disclose is a cause for suspension and debarment on any contract, and that cause also covers significant overpayments.
• Disclosure and cooperation are mitigating factors when the government decides whether a contractor is presently responsible.

---

Where this fits

Federal buyers look for vendors they can trust with public money, and a clean integrity record sits alongside security, registration and past performance in that judgement. It helps to know how your company looks across the categories buyers review before an issue ever comes up. Score your company’s federal readiness to see where you stand.

---

Related reading

• Suspension and Debarment for Software Companies
• The Procurement Integrity Act for Software Companies
• Responsibility Determinations for Software Companies
• Representations and Certifications for Software Companies
• Secure Software Attestation for Software Companies