On July 12, 2005, the Department of Defense ("DOD") proposed an amendment to the Defense Federal Acquisition Regulation Supplement ("DFARS") which would require parties subject to the DFARS to implement an Internal Controls Programs ("ICP") to ensure their compliance with the International Traffic In Arms Regulations ("ITAR" 22 CFR 120-130) and the Export Administration Regulations ("EAR" 15 CFR 730-774). [70 Fed. Reg. 39976 (July 12. 2005)] If adopted in its current form, this regulation would represent the first affirmative regulatory requirement for the implementation of an ICP for ITAR and EAR compliance. Presumably, it would also make all aspects of a contractor's ICP subject to government audit, thereby raising significant issues with regard to attorney-client privilege in internal investigations.
The proposed rule does not appear to limit the contractor's obligation to implement an ICP to the scope of an individual contract. Rather, it would require the contractor to implement a comprehensive compliance program with certain prescribed elements. Specifically, the contractor must:
- comply with all applicable laws and regulations regarding export controlled information and technology;
- maintain an effective export compliance program, which must include adequate controls over physical, visual, and electronic access to export-controlled information and technology to ensure that access by foreign firms and individuals (including foreign national employees of the contractor) is restricted. The access control program must specifically include unique badging requirements for foreign nationals, as well as segregated work areas for export-controlled technology;
- conduct initial and periodic training on export compliance controls for those employees who have access to export-controlled information and technology; and
- perform periodic assessments to ensure full compliance with Federal export laws and regulations.
Potential Headaches
This amendment, when taken in the context of the broader Federal Acquisition Regulation Supplement (FARS), has several potential major consequences. To begin with, it appears that the auditing requirements of DFARS subject a company's export compliance program to scrutiny for at least three years following the close of the contract. [48 C.F.R. § 52.215-2(f)]
More importantly, the requirement of a "periodic assessment" creates significant concerns regarding attorney work-product in internal compliance investigations. The FARS currently requires that if a company is required to provide cost, funding, or performance reports, the company must also provide "supporting records and materials" in order to allow the government to evaluate .the effectiveness of [the company's] policies and procedures.. [48 C.F.R. § 52-215.2(e)] The requirement for periodic self-assessments and training would certainly appear to fall within the category of "performance reports." If so, and if these periodic assessments are carried out by counsel, the proposed rule raises a significant issue as to whether the signing of a contract subject to the DFARS would constitute a waiver of privilege as it relates to internal ITAR and EAR compliance investigations.
DOD has asked for comments on the proposed rule, and the deadline has been extended to October 12, 2005. [70 Fed. Reg. 46807 (August 11. 2005)]
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
