Published 2026 | TIKC NewsWire
Many contractors are surprised to learn that having an ethics program is not optional goodwill. On contracts above certain thresholds, the government requires a written code of business ethics and conduct, employee awareness and training, and, for larger awards, an internal control system and a mechanism to detect and disclose misconduct. It is a contract clause, not a suggestion. The companies that treat it as a binder on a shelf get the worst of both worlds: the obligation without the protection. The ones that build it for real gain the single best defense they have when something goes wrong.
What the rule requires
The Federal Acquisition Regulation requires contractors, above dollar and schedule thresholds, to have a written code of business ethics and conduct and to make it available to every employee involved in the work. Larger contracts add more: ongoing ethics awareness and compliance training, and an internal control system reasonably designed to prevent and detect improper conduct. That internal control system is expected to include things like oversight by senior people, periodic risk assessment, mechanisms for employees to report wrongdoing without fear, and timely discipline and correction when something is found.
Why it is really about detection
The heart of the requirement is not the document. It is whether your company can find misconduct before it metastasizes. A real internal control system surfaces the billing error, the conflict, the cut corner, while it is still small and fixable. That matters enormously because the same framework ties directly to the mandatory disclosure rule: if you find credible evidence of certain violations, you may be required to disclose it. A program that cannot detect anything cannot disclose anything, and that failure is itself a problem.
The internal hotline is the point
The most valuable piece of an ethics program is a channel that lets employees raise concerns internally, safely, and early. Get this right and your people bring problems to you first. Get it wrong, through retaliation, indifference, or a culture that punishes the messenger, and they take those same concerns to the government as a qui tam relator. Every mature compliance program understands this trade: the internal report you welcome is the external lawsuit you avoid.
It protects the people, not just the company
A genuine ethics program also matters when enforcers come looking, because the government and courts weigh whether a company had real controls or merely paper ones. A credible program can mitigate consequences, while a sham one can aggravate them, and in a world of individual accountability, leaders are judged by whether they built and honored real controls. The code you actually live by is the difference between an isolated bad act and a pattern that implicates the whole company and its officers.
What to do now
- Write a real code. Adopt a written code of business ethics and conduct, and get it into the hands of everyone on the work.
- Train and repeat. Provide ongoing ethics and compliance training, not a one-time slide deck.
- Build detection in. Create an internal control system with oversight, risk assessment, and real discipline when issues surface.
- Run a safe hotline. Give employees a protected way to report concerns internally, and never retaliate.
- Connect it to disclosure. Make sure findings route to the people who decide whether a mandatory disclosure is required.
An ethics program is not paperwork you buy to pass a clause. It is the nervous system that lets your company feel a problem early and fix it on your terms. Build it to actually work, and it will be the first thing that saves you when you need saving. Brick by brick.
FAQ
Is an ethics program actually required?
Yes. Above certain thresholds the FAR requires a written code of business ethics and conduct, employee access to it, and for larger contracts ongoing training and an internal control system. It is a contract clause.
What should the internal control system do?
It should be reasonably designed to prevent and detect improper conduct, with senior oversight, periodic risk assessment, a safe way for employees to report, and timely discipline and correction.
How does it connect to mandatory disclosure?
Detection feeds disclosure. If your program finds credible evidence of certain violations, you may be required to disclose it, so a program that cannot detect cannot meet that duty.
Why does a real program protect me?
Enforcers weigh whether controls were genuine or cosmetic. A credible program can reduce consequences and keep a single bad act from becoming a company-wide and personal problem.
Sources
Federal Acquisition Regulation. (2026). Subpart 3.10, Contractor Code of Business Ethics and Conduct, and clause 52.203-13.
U.S. Sentencing Guidelines. (2026). Effective compliance and ethics program criteria.
This article is general information, not legal advice.
About the Author
Melanie Patterson
Founder and CEO of Team Integrity Knowledge Center and creator of GovCon iSource. Former nurse turned entrepreneur with over 10 years guiding small, women-owned, and minority-owned businesses to over $10 million in government awards. Build, grow, scale, brick by brick. Contact
