Your Supply Chain at Risk: A Secret Blacklist for Government Contractors? Part 1

The American Small Business League recently released a statement that Section 815 of Senate bill 3454, the National Defense Authorization Act of 2011, "may allow senior Department of Defense (DoD) officials to secretly 'blacklist' government contractors at their discretion and without notice to the contractor or accountability to the public."

This is, of course, the same bill that contains provisions for withholding payment from contractors whose business systems are deemed inadequate. The bill follows proposed changes to the DFARS that would withhold payments up to 100% for "inadequate" business systems, including purchasing systems, which in turn includes subcontracting.

That federal government officials want more and more control over the contracting and subcontracting process is nothing new. Section 815, which covers risk to the supply chain, poses additional challenges for contractors and subcontractors.

At first glance, Section 815 seems to apply only to technology vendors and their suppliers, and it seems to be intended to block terrorists and hackers from maliciously manipulating mission-critical hardware and software. It appears to be a well-intended provision for ensuring that crucial tech vendors--and the military groups who depend on them--can't be shut down by a weak link in the supply chain. Who would be against that?

But the devil is in the details. A more thorough reading reveals some very open-ended wording that could lead to the section being used to justify draconian measures taken arbitrarily against contractors and subcontractors, leaving them with no recourse to restore their businesses and good names.

Section 815 starts by giving the head of "an agency" (which agencies are allowed this power is not specified) to establish qualification requirements for the reduction of supply chain risk, and restrict competition to companies who can meet those requirements. Apparently irrespective of these qualification requirements, the agency head can establish supply chain risk as a major criteria for evaluation of a bid. This begs the question of whether Section 815 could be construed as giving agency heads the ability to exclude non-tech contractors and subcontractors.

The statute does not cover what happens when different agencies establish different qualification requirements. How can a small business keep up with these requirements on top of all the Federal Acquisition Regulations, even if it has an effective FAR management system? These requirements are only available upon request--so contractors must know to request them and contracting officers must be knowledgeable enough to deliver them.

The section goes on to outline how a company that either cannot meet qualification requirements or has been deemed to pose a "supply chain risk" can be restricted from competition either as a contractor or subcontractor. It then states that a determination against a company must be in writing but does not have to be disclosed via Federal Register, that it is at the sole discretion of the agency head or senior procurement executive, and is not subject to review by either a GAO protest or the Federal court.

It doesn't take a contracting expert or attorney to point out the obvious potential for abuse by agency leaders. There are no apparent checks and balances to this system. On top of this, there is another problem that the bill doesn't even address--how the actions of one agency head affects another. Can the head of one agency blacklist a contractor who does business with multiple agencies and therefore cause other agencies to terminate contracts and blacklist the contractor as well? If the answer is yes, then what happens when one agency head blacklists someone another agency head needs to provide crucial systems? And what about contractors who are caught in the middle of inter-agency power struggles?

This is only part of the problem with this pending legislation. We'll examine some of the implications for prime contractors as well as smaller subcontractors next week.

Contractor GTSI suspended; who is next?

As we reported earlier on our Twitter feed, the SBA has suspended GTSI from government work based on allegations of contracting fraud. According to a Washington Post article:

"There is evidence that GTSI's prime contractors had little to no involvement in the performance of contracts, in direct contravention of all applicable laws and regulations regarding the award of small business contracts," an SBA official wrote in a letter to GTSI's chief executive, Scott W. Friedlander. "The evidence shows that GTSI was an active participant in a scheme that resulted in contracts set-aside for small businesses being awarded to ineligible contractors."

The article goes on to say it's the first time in decades that such an action has been taken.

This comes as no surprise to government contracting newshounds. This administration has stated many times that stopping contracting fraud, waste, and abuse is a priority. President Obama's memorandum back in March challenges federal agencies to ferret out companies that don't follow contracting rules.

Contracting and subcontracting, including small business contracting, have become increasingly important targets in Congress; as we reported earlier, the new Small Business Jobs and Credit Act aims to enforce subcontracting plans. Congress is looking at agencies like the Department of Homeland Security to ensure proper management and oversight of contracts. And Congress may yet pass a version of the DoD's payment withholding plan in the National Defense Authorization Act 2011 for contractors who don't follow the rules.

If a large contractor like GTSI can be taken to task under this increased oversight, it is likely that other contractors will as well. Furthermore, knowledge of the Federal Acquisition Regulations is increasingly at a premium; even the smallest subcontractors could stand to lose business if they are not followed. No prime contractor will want to assume the risk of being suspended because of a failure to follow regulations along the supply line. Contracting officers will be on the lookout for companies that can demonstrate good management of the applicable regulations. An effective FARS management system reduces the regulatory burden and ensures compliance, which in turn protects against suspension.

It will be interesting to see what other companies may be suspended by the SBA; if what is alleged against GTSI is true, it is possible there are many other "GTSIs" out there that could be suspended. Time will tell, but in the meantime, contractors and subcontractors should take a close look at their FARS management and ask themselves if they can prove their competence in this era of increased oversight.

Contracting Principles the DoD Forgot, Part 4: The Proposed Purchasing System DFAR: Consequences for Subcontractors and Prime Contractors

Our last closely examined area of the proposed rule brings us back to the topic of subcontracting. The following Purchasing System Administration clause is noteworthy for subcontractors as well as prime contractors.

"252.244–7XXX Contractor purchasing system administration.
As prescribed in 244.305–7X, insert the following clause:
Contractor Purchasing System Administration (Date)
(a) Definitions. As used in this clause—
Deficiency means a failure to maintain any element of an acceptable purchasing system.
Purchasing system means the Contractor’s system or systems for purchasing and subcontracting including make or buy decisions, the selection of vendors, analysis of quoted prices, negotiation of prices with vendors, placing and administering of orders, and expediting delivery of materials."

Note that the defined purchasing system includes systems for subcontracting and information related to subcontractors and their proposals to, and contracts with, the prime contractor. It is important to note that this proposed rule 252.244–7XXX is a business-transaction-information-and-documentation-requirement as well as a business systems and business systems administration rule. It almost looks like the beginning of a required ISO quality management system for purchasing transactions and documentation. Also, please note that there is no exception or exclusion in this definition for very small vendors.

The clause continues:

"Purchasing system includes, but is not limited to—
(1) Internal audits or management reviews, training, and policies and procedures for the purchasing department to ensure the integrity of the purchasing system;
(2) Policies and procedures to assure purchase orders and subcontracts contain all flow down clauses, including terms and conditions required by the prime contract and any clauses required to carry out the requirements of the prime contract;"

Training for many contractor purchasing departments is often occasional and insufficient. If adopted in some similar form, such a final rule may trigger greater attention to in-house and externally sourced training. Also in that event, more attention by contractors to their policies and procedures for purchasing departments will likely be necessary to avoid possible deficiency findings. An annual review of all purchasing department policies and procedures, and documentation confirming the thoroughness of that review, will now be more important than ever before. These points seem supported by subsequent paragraphs of this proposed FAR that are noted below. Overall, a final rule similar to the proposed rule would discourage caviler treatment of company policies and procedures. The withholding penalties would be too extreme to risk.

The clause continues:

"(3) An organizational and administrative structure that ensures effective and efficient procurement of required quality materials and parts at the most economical cost from responsible and reliable sources;
(4) Selection processes to ensure the most responsive and responsible sources for furnishing required quality parts and materials and to promote competitive sourcing among dependable suppliers so that purchases are reasonably priced and from sources that meet contractor quality requirements;"

Given such requirements in a final rule, increased use of ISO qualified subcontractors seems highly desirable.

The clause continues:

(5) Performance of price or cost analysis on purchasing actions; and

Presumably explanatory documentation of these analyzes would be necessary. Paragraph 252.244–7XXX(c)(5) below seems to support that thought.

The clause continues:

(6) Procedures to ensure that proper types of subcontracts are selected and that there are controls over subcontracting, including oversight and surveillance of subcontracted effort.

It will be interesting to see whether supplemental requirements will be added over time such as details of necessary elements in a subcontracting and subcontracts oversight and surveillance procedure. How far will contractors have to go in their subcontracting procedures in order to satisfy the government? Will a new internal or external legal audit and formal opinion-letter certification eventually become viewed as helpful or necessary?

The clause continues:

(b) General. The Contractor shall establish and maintain an acceptable purchasing system. Failure to maintain an acceptable purchasing system, as defined in this clause, may result in disapproval of the system by the ACO and/or withholding of payments.
(c) System requirements. (1) Have an adequate system description including policies, procedures, and operating instructions that comply with the FAR and DFARS.

Note in 252.244–7XXX(c)(1) above the words "policies, procedures, and operating instructions that comply with the FAR and DFARS". Couple these requirements with 252.244–7XXX(b)’s statement above that: "Failure to maintain an acceptable purchasing system, as defined in this clause, may result in disapproval of the system by the ACO and/or withholding of payments." What do you conclude? Consider the following possible conclusions.

1) Perfection Required Regarding DFARS. Under the proposed 252.244–7XXX(b) and (c)(1) it appears that less that perfect (i) awareness or knowledge, (ii) interpretation and understanding, and (iii) application or implementation, of all applicable then-current DFARS in "policies, procedures, and operating instructions" may result in payment withholding or purchasing system disapproval.

Requirements for contractor perfection are often problematic. In connection with 252.244–7XXX(b)’s statement above, how will "an acceptable purchasing system" be defined specifically or precisely, in other words, in greater detail than by 252.244–7XXX(c)’s criteria? To illustrate, how quickly must subcontractor invoices be approved or rejected, and if approved, paid? Is it "acceptable" to pay a subcontractor within 60 or 90 days of invoice receipt, or of invoice approval? Will delays longer that a few weeks or a month be viewed as a deficiency? Software systems for the purchasing function are common among contractors. Is it "acceptable" if a new release from a software licensor contains a bug that takes weeks or months to be fixed when the bug affects the contractor’s purchasing system, for example, changing the calculations or other content in invoices or purchase orders? It is hard to be perfect when you do not know the details of all requirements.

2) Confusing "Mandatory" Versus "Optional" Inconsistency. There appears to be a confusing inconsistency between "252.242–7XXX, Business Systems" that we previously reviewed, and "252.244–7XXX Contractor purchasing system administration".

(i) In 252.242–7XXX, Business Systems, we see a mandatory penalty. Note the mandate in 252.242–7XXX(c)(2): "If the ACO determines that the Contractor’s business system contains deficiencies, the final determination will include a notice of a decision to withhold payments." Next, note the mandate in 252.242–7XXX(d)(1) to "immediately withhold ten percent of each of the Contractor’s payments under this contract" for deficiencies in a business system. We must remember of course that a purchasing system is a type of covered business system.

(ii) However, in 252.244–7XXX(b)’s statement we see an optional penalty: "Failure to maintain an acceptable purchasing system, as defined in this clause, may result in disapproval of the system by the ACO and/or withholding of payments."

Which is it, "will" or "may" withhold payments? There appears to be no explanation.

3) ACO Inconsistency. We must recognize the probability that ACOs will not be consistent across contracts and over time. Inconsistency in ACO actions is a major danger in the near future after the final rule issues, and years later, because of potential unexpected withholdings for reasons not triggering a withholding under (i) a contractor’s other then-current, in-progress contracts, (ii) a competitor’s then-current contracts, or (iii), in the future, under a contractor’s old contracts. The same ACO may be consistent, but the consistency issue clearly arises with different ACOs. Inconsistent withholding decisions seem unavoidable even if ACOs receive training in an attempt to minimize them. After all, ACO actions are not the actions of judges in courts of law who are bound by precedent. Undoubtedly there will be some inconsistencies across contracts or over time that will be reasonable and fair given the respective surrounding circumstances, but equally undoubtedly other inconsistencies across contracts or over time will be unreasonable, unfair, costly, and may lead to considerable harm to the contractor involved and its workforce, shareholders, and senior management.

4) Uncertainty. The lack of details in DFAR requirements, on the one hand, and ACO inconsistency, on the other hand, will likely initiate and maintain some degree of contractor uncertainty over which application or implementation imperfections or idiosyncrasies will be "acceptable" in any particular newly-awarded contract and at any particular point in time. Focusing only on purchasing systems for the moment, the potential withholding or system disapproval consequences of a purchasing system imperfection are draconian. The risk of payment withholding or purchasing system disapproval due to imperfections is too dire to treat lightly. Assuming the requirements of the final Business Systems DFAR are at least somewhat similar to those of the proposed DFAR, it will be highly desirable for contractors to undertake any reasonable steps to improve DFAR (i) awareness or knowledge, and (ii) interpretation and understanding. Contractors would not want one of these more controllable sources of risk to trigger a withholding. Application or implementation imperfections or idiosyncrasies will cause more than enough problems. Overall, awareness and knowledge failures, and interpretation and understanding failures, must be minimized.

5) Best Solutions. It follows that prudence suggests discontinuing any reliance on sources for DFARS, and FARS as well, that are unnecessarily incomplete or less than reasonably current. Prudence further suggests more vigilant research into and analysis of new DFARS, and FARS as well, rather than accepting prevalent internal interpretations without question because they may be blind to, or may incompletely recognize, some potential dangers.

Assuming the requirements of the final DFAR Business Systems rule are at least somewhat similar to those of the proposed rule, the time will have come for more attention to, and more professionalism in, FAR/DFAR awareness/knowledge, and FAR/DFAR interpretation and understanding. Occasional and piece-meal updating of FARS and DFARS is no longer adequate in an environment of countless new grounds for a withholding penalty. Occasionally discussing proposed or new FARS/DFARS is insufficient. Occasionally finding and reviewing an article on the interpretation of a proposed or new FAR/DFAR is insufficient. Contractors need a FAR/DFAR management system.

Contracting Principles the DoD Forgot, Part 3: “Business Systems” Excerpts From The Proposed Mandatory Withholding DFAR

The following passages from the proposed rule will disclose some key processes and begin to suggest its penalties. For those readers unfamiliar with the terminology, an "ACO" is an Administrative Contracting Officer.

"Subpart 242.70—Business Systems
242.70X1 Business system deficiencies.
(a) Definitions. "Acceptable business systems" and "Business systems" are defined in the clause at 252.242–7XXX, Business Systems.
(b) Reporting of deficiencies. The auditor or other cognizant functional specialist shall document deficiencies in a report to the ACO. The report shall describe the deficiencies in sufficient detail to allow the contracting officer to understand what the contractor would need to correct to comply with the applicable standard or system requirement, and the potential magnitude of the risk to the Government posed by the deficiency. Follow the procedures at PGI 242.70X1(b) for reporting of deficiencies.
(1) Initial determination of deficiencies. If the ACO makes a determination that there is a system deficiency, the ACO shall provide an initial determination of deficiencies and a copy of the report to the contractor and require the contractor to submit a written response in accordance with the clause at 252.242–7XXX, Business Systems.
(2) Evaluation of contractor's response. The ACO, in consultation with the auditor or cognizant functional specialist, shall evaluate the contractor's response and make a final determination.
(3) Notification of ACO final determination. The ACO shall notify the contractor in writing of the ACO's final determination with copies provided, as applicable, to the auditor; other cognizant functional specialists; and affected contracting activities and contract administration offices. The ACO shall take one of the following actions—
(i) Withdraw the initial determination of deficiencies. The ACO shall withdraw the initial notification if the contractor has corrected all deficiencies or the ACO agrees with the contractor's written response disagreeing with the initial determination of deficiencies; or
(ii) The ACO shall notify the contractor of the ACO's decision to implement payment withholding in accordance with the clause at 252.242–7XXX, Business Systems. The notice shall—
(A) Identify any deficiencies requiring correction;
(B) Inform the contractor that—
(1) The contractor must correct the deficiencies;
(2) The contractor must submit an acceptable corrective action plan within 45 days if the deficiencies have not been corrected within that 45 day timeframe;
(3) Payments shall be withheld in accordance with 252.242–7XXX, Business Systems, until the ACO determines that all deficiencies have been corrected; and
(4) The ACO reserves the right to take other actions within the terms and conditions of the contract.
(c) Monitoring contractor's corrective action. The Government shall monitor the contractor's progress in correcting the deficiencies and shall notify the contractor of the decision to decrease or increase the amount of payment withholding in accordance with 252.242–7XXX, Business Systems.
(d) Correction of system deficiencies.
(1) If the contractor notifies the ACO that the contractor has corrected the system deficiencies, the ACO shall request the auditor or other cognizant functional specialist to review the correction to determine if the deficiencies have been resolved.
(2) The ACO shall determine if the contractor has corrected the deficiencies.
(3) If the ACO determines the contractor has corrected all deficiencies, the ACO shall discontinue withholding payments.
(e) System review matrix. Refer to the matrix at PGI 242.70X1(e) to crossreference DCAA internal control reviews and other business system audits to the list of "business systems" defined at 252.242–7XXX, Business Systems."

Note the mandate above in 242.70X1(b)(3)(ii)(B)(3) to withhold payments until all deficiencies have been corrected. Note also in 242.70X1(c) above the ability of the ACO to decrease or increase the amount of payment withholding. Then in 242.70X1(d)(3) above the ACO may discontinue withholding payments when the ACO determines the contractor has corrected all deficiencies. The proposed rule continues:

"242.70X2 Contract clause.
Use the clause at 252.242–XXXX, Business Systems, in solicitations and contracts when the solicitation or contract includes any of the following clauses:
(a) 52.244–2, Subcontracts.
(b) 52.245–1, Government Property.
(c) 252.215–7002, Cost Estimating System Requirements.
(d) 252.234–7002, Earned Value Management System.
(e) 252.242–7004, Material Management and Accounting System.
(f) 252.242–7YYY, Accounting System Administration."
* * * * *

Note the reference in 242.70X2(a) above to subcontracts. Subcontracting is addressed in several subsequent locations within the proposed rule including at the end, in the topic area of contractor purchasing systems. Before that point we see other major systems of the contractor addressed in Part 252—Solicitation Provisions and Contract Clauses. We also see in Part 252 the proposed clause at 252.242–7XXX, Business Systems, addressing some key processes and the withholding-payments penalty.

"252.242–7XXX Business systems.
As prescribed in 242.70X2, use the following clause:
Business Systems (Date)
(a) Definitions. As used in this clause—
Acceptable business systems means business systems that comply with the terms and conditions of this contract.
Business systems means—
(1) Accounting system, if this contract includes the clause at 252.242–7YYY, Accounting System Administration;
(2) Earned value management system, if this contract includes the clause at 252.234–7002, Earned Value Management System;
(3) Estimating system, if this contract includes the clause at 252.215–7002, Cost Estimating System Requirements;
(4) Material management and accounting system, if this contract includes the clause at 252.242–7004, Material Management and Accounting System;
(5) Property management system, if this contract includes the clause at 52.245–1, Government Property; and
(6) Purchasing system, if this contract includes the clause at 52.244–2, Subcontracts.
(b) General. The Contractor shall establish and maintain acceptable business systems in accordance with the terms and conditions of this contract.
(c) System deficiencies.
(1) The Contractor shall respond in writing within 30 days to an initial determination of deficiencies from the ACO that identifies deficiencies in any of the Contractor's business system.
(2) The ACO will evaluate the Contractor's response and notify the Contractor in writing of the final determination as to whether the business system contains deficiencies. If the ACO determines that the Contractor's business system contains deficiencies, the final determination will include a notice of a decision to withhold payments.
(d) Withholding payments.
(1) If the Contractor receives a final determination with a notice of the ACO's decision to withhold payments for deficiencies in a business system required under this contract, the ACO will immediately withhold ten percent of each of the Contractor's payments under this contract. The Contractor shall, within 45 days of receipt of the notice, either correct the deficiencies or submit an acceptable corrective action plan showing milestones and actions to eliminate the deficiencies.
(2) If the Contractor submits an acceptable corrective action plan within 45 days of receipt of a notice of the ACO's intent to withhold, but has not completely corrected the identified deficiencies, the ACO will reduce the amount withheld to an amount equal to five percent of each payment until the ACO determines that the Contractor has corrected the deficiencies in the business system. However, if at any time the ACO determines that the Contractor fails to follow the accepted corrective action, the ACO will increase the amount of payment withheld to ten percent of each payment under this contract until the ACO determines that the Contractor has completely corrected the deficiencies in the business system.
(3) If the ACO is withholding payments for deficiencies in more than one business system, the cumulative percentage of payments withheld shall not exceed fifty percent on this contract.
(4) Notwithstanding any other rights or remedies of the Government under this contract, including paragraphs (d)(1) through (d)(3) of this clause, if the ACO determines that there are one or more system deficiencies that are highly likely to lead to improper contract payments being made, or represent an unacceptable risk of loss to the Government, then the ACO will withhold up to one-hundred percent of payments until the ACO determines that the Contractor has corrected the deficiencies.
(5) For the purpose of this clause, payment means any of the following payments authorized under this contract:
(i) Interim payments under—
(A) Cost reimbursement contracts;
(B) Incentive type contracts;
(C) Time-and-materials contracts;
(D) Labor-hour contracts.
(ii) Progress payments.
(iii) Performance-based payments.
(6) The withholding of any amount or subsequent payment to the Contractor shall not be construed as a waiver of any rights or remedies the Government has under this contract.
(7) Notwithstanding the provisions of any clause in this contract providing for interim, partial, or other payment on any basis, the ACO may withhold payment in accordance with the provisions of this clause.
(8) The payment withholding authorized in this clause is not subject to the interest penalty provisions of the Prompt Payment Act.
(e) Correction of deficiencies.
(1) The Contractor shall notify the ACO in writing when the Contractor has corrected the business system's deficiencies.
(2) Once the Contractor has notified the ACO that deficiencies have been corrected, the ACO will take one of the following actions:
(i) If the ACO determines the Contractor has corrected all deficiencies in a business system, the ACO will discontinue the payment withholding under this contract associated with that business system and release any monies previously withheld that are not also being withheld due to deficiencies on other business systems under this contract. Any payment withholding in effect on other business systems under this contract will remain in effect until the deficiencies for those business systems are corrected.
(ii) If the ACO determines the Contractor has not corrected all deficiencies, the ACO will continue the withholding payments in accordance with paragraph (d) of this clause and not release any monies previously withheld.
(End of clause)"

Note the general requirement in 252.242–7XXX(b) above to establish and maintain acceptable business systems. Note the mandate in 252.242–7XXX(c)(2) above: "If the ACO determines that the Contractor's business system contains deficiencies, the final determination will include a notice of a decision to withhold payments." Next, note the mandate in 252.242–7XXX(d)(1) above to "immediately withhold ten percent of each of the Contractor's payments under this contract" for deficiencies in a business system. Then note 252.242–7XXX(d)(3) above explaining that deficiencies in more than one business system can justify withholding up to 50% of payments under the contract.

This already shocking proposed rule now gets worse. Note the 100% mandate in 252.242–7XXX(d)(4) above: "if the ACO determines that there are one or more system deficiencies that are highly likely to lead to improper contract payments being made, or represent an unacceptable risk of loss to the Government, then the ACO will withhold up to one-hundred percent of payments until the ACO determines that the Contractor has corrected the deficiencies." Please note that there is no maximum time limit for withholding in this clause 252.242–7XXX. Instead, under 252.242–7XXX(e)(2)(ii) above it appears that withholding could theoretically continue indefinitely.

Most of the points noted above will be discussed later in this article. For the present, an observation appears warranted. If not earlier, then by this point it seems obvious that the decision makers behind this proposed rule would flunk our hypothetical Introduction to Procurement course. In fact, in my role as their helpful teacher I would encourage them to find a career outside the field of procurement.