By Chuck Gallagher — Business Ethics Keynote Speaker and Trainer
TL;DR: Chuck Gallagher, business ethics keynote speaker, explains why the FAR’s code-of-ethics requirement for government contractors demands a document built for federal-specific risk, not a copy-pasted employee handbook policy.
She’d just won her company’s first subcontract over $7.5 million. Good news, until she read the fine print. Buried in the flow-down clauses sat FAR 52.203-13. Thirty days to produce a written code of business ethics and conduct her general counsel had never touched before. Thirty days. Not thirty months. Trust me, that clock catches good companies flat-footed more than anyone likes to admit.
What Is a Government Contractor Code of Ethics, Really?
As a business ethics keynote speaker, I talk to executives every year who assume the ethics policy already sitting in their employee handbook covers this ground. It doesn’t. The code required under FAR 52.203-13 is a written standard of conduct built specifically for government contract work, paired with a training program and an internal control system. Together those three pieces form what the government calls compliance infrastructure. The underlying policy lives in FAR Subpart 3.10, “Improper Business Practices and Personal Conflicts of Interest.” The clause itself is what turns that policy into a binding term in your contract, and it applies whether the company is the prime contractor or sits several tiers down as a subcontractor.
When Does the FAR Actually Require a Written Code?
Here’s the number that matters: $7.5 million. When a contract or subcontract is expected to exceed that amount and run longer than 120 days, the clause applies, and the company has thirty days after award to have a code in writing and in the hands of every employee working the contract. There are narrow exceptions for certain commercial product or service contracts and for work performed entirely outside the United States. Below the dollar threshold, the requirement isn’t gone. It’s just not mandatory. FAR 3.1002 still says government contractors must conduct themselves with the highest degree of integrity and honesty, and should have a written code of business ethics and conduct, backed by a training program and internal controls sized to the company. The government is telling you what good practice looks like whether or not your contract forces the issue.
What Should Actually Be in the Document?
This is where a lot of companies get tripped up. They assume one document covers everything. A code built for government work has to speak to procurement integrity, meaning the protection of nonpublic bid and source selection information. It has to address accurate representations in proposals and invoices, anti-bribery and anti-kickback rules, and both personal and organizational conflicts of interest. It has to cover post-government employment restrictions for anyone who’s worked on the federal side, antitrust and fair competition rules, cost accounting and timekeeping accuracy, protection of government property and data, and the mandatory obligation to disclose certain violations to a federal inspector general. That’s a long list, and it’s a different list than the one sitting in most HR departments.
Why Doesn’t a General Ethics Policy Already Cover This?
Most companies already have something. An anti-harassment policy. A data privacy policy. Maybe an insider trading policy. Good things to have. None of them touch procurement integrity, government cost accounting, timekeeping accuracy, or the mandatory disclosure obligation to a federal inspector general. Those are federal-specific risks, and a general corporate policy written for the whole company was never built to catch them. I’ve watched executives assume coverage that simply wasn’t there, and by the time they find out, the moment to fix it quietly has already passed.
What’s Actually at Stake If a Company Skips It?
The False Claims Act doesn’t care how big your contract is. It imposes treble damages plus a penalty assessed per claim, not as a percentage of contract value. One falsified timesheet on a small contract carries the same statutory framework as a billing error on a program worth a hundred times more. Now, the way I see it, that’s the part companies underestimate. Size doesn’t buy you cover.
If a compliance problem does surface, having the code in place before it happened matters. The U.S. Sentencing Guidelines and the Department of Justice’s own Evaluation of Corporate Compliance Programs look for the same hallmarks: leadership commitment, written standards, a designated compliance officer, training, a confidential reporting channel, protection against retaliation, monitoring, and consistent discipline when something goes wrong. A functioning program built before the incident becomes a mitigating factor in suspension and debarment proceedings. A program built after the incident is just paperwork.
I’ve built my whole career, as a business ethics keynote speaker, around one plain fact: every choice has a consequence. A written code doesn’t erase risk. But the absence of one turns an ordinary billing mistake into a much bigger problem, and it turns “we didn’t know” into an explanation nobody in Washington wants to hear.
The fix here isn’t complicated. It doesn’t require a law degree or a six-figure consultant retainer. It requires a document, tailored to the actual risks of federal work, given to every employee touching the contract, and backed by training that isn’t just a checkbox. Companies that build this before the government forces the issue are the ones still standing when the audit letter arrives. The ones who waited are the ones explaining themselves.
Frequently Asked Questions
What is a government contractor code of business ethics and conduct?
It’s a written set of standards addressing ethics risks specific to federal contract work, such as procurement integrity, accurate billing, and conflicts of interest. It’s required under FAR 52.203-13 and paired with a training program and an internal control system.
When is a written code of ethics required under the FAR?
It becomes mandatory when a contract or subcontract is expected to exceed $7.5 million and has a performance period longer than 120 days. Companies then have thirty days after contract award to put a written code in place, unless narrow exceptions apply.
Does a company’s general ethics policy already satisfy this FAR requirement?
Usually not. A general corporate ethics policy typically covers workplace topics like harassment and data privacy, but it rarely addresses government-specific risks such as procurement integrity, cost accounting, or mandatory inspector general disclosure.
What happens if a government contractor is out of compliance and an issue arises?
The False Claims Act imposes treble damages plus penalties assessed per claim, regardless of contract size. Without a functioning compliance program already in place, a company also loses a recognized mitigating factor that the DOJ and Sentencing Guidelines look for during enforcement decisions.
Is a written ethics code required for smaller government contracts too?
Not mandatorily, but the FAR recommends one. As a business ethics keynote speaker, I tell contractors that FAR 3.1002 calls for the highest degree of integrity and honesty from every company doing federal work, regardless of size.
Building this code isn’t a one-afternoon project, and getting it right the first time saves a company from relitigating it after an audit. Visit ChuckGallagher.com to bring Chuck Gallagher in to walk your leadership team through what a defensible, FAR-specific code of ethics actually looks like for your contracts.
Five Questions for Reflection
1. Does your organization’s ethics policy actually address procurement integrity, cost accounting, and inspector general disclosure — or does it just assume those risks are covered?
2. If your company won a new subcontract tomorrow that crossed the $7.5 million threshold, could you produce a compliant written code within thirty days?
3. Where in your organization would a falsified timesheet or an inflated invoice most likely go unnoticed until it was too late?
4. If a compliance problem surfaced today, would your existing program actually reflect the hallmarks — leadership commitment, training, reporting, discipline — that DOJ and the Sentencing Guidelines look for?
5. What would cost your company more: building this code now, or explaining its absence to a federal investigator later?
