These questions emerged from a workshop I ran last month for defense contractors. We'd just discussed the Hawaii indictment, where two men allegedly hid $1.25 million in bribes within government contract costs, and the room fell silent. Then someone asked, "We do the training. We have the code. How does this still happen?"
This led to the most honest hour I've spent in a compliance meeting all year. Here's what people actually wanted to know.
Q: Our contracts require FAR 52.203-13 compliance. Doesn't that mean we're covered?
No, it means you've got the paperwork.
FAR 52.203-13 applies when a contract exceeds $6 million and runs 120 days or longer. It requires a written Standards of Business Conduct, an ongoing ethics awareness program, internal controls to detect criminal conduct, periodic risk assessments, and a confidential reporting mechanism. The Hawaii case allegedly ran for roughly two years despite all of that being in place.
Compliance with a regulation isn't the same as preventing the behavior it aims to stop. You can check every box and still miss a scheme running in plain sight. The question isn't whether you've got the program, but whether the program would catch someone who knows exactly how it works.
Q: What's the difference between rule-based training and behavior-focused training?
Rule-based training tells people what not to do. Behavior-focused training helps them recognize why they might do it anyway.
Most compliance courses follow the same script: here's the law, here's the penalty, sign here. That works until someone's underwater on their mortgage, nursing a grudge against their manager, or convinced the company owes them something. Then the rules don't matter because the person has already justified their actions.
Behavior-focused training asks three questions out loud, with the people who handle the invoices:
- What need is loud right now? Financial stress, lifestyle creep, unusually close vendor relationships, control issues.
- Where's the opportunity? Who can move money without a second set of eyes?
- What story are people telling themselves? "Everyone does it." "I'll pay it back." "They'd never notice."
These questions don't fit on a slide deck. They're uncomfortable, but they're the ones that matter.
Q: How do you spot behavioral warning signs without turning into the office spy?
You don't need to investigate people. You need to notice patterns.
Financial difficulties aren't always visible, but lifestyle changes often are. Someone who suddenly can't make happy hour because of "money stuff" and then shows up in a new car. An employee who takes every vendor call behind closed doors. A manager who insists on approving every invoice personally and gets defensive when you suggest cross-training.
That last one's the tell. In one case I reviewed, an executive assistant resisted a job-sharing program. Ten days after someone else finally sat in her chair, the company uncovered an embezzlement scheme worth over $2.1 million.
She didn't start out dishonest. Almost nobody does. But she had need, opportunity, and a story that made sense to her. And nobody asked the uncomfortable question until it was too late.
Q: If someone's going to commit fraud, won't they just ignore the training anyway?
That's the wrong frame. You're not training the person who's already decided. You're training the person who's one bad month away from deciding.
Nobody wakes up and chooses to become a felon. They make a small choice, then a slightly larger one that the first choice made easier. Then the choice after that isn't really a choice anymore; it's maintenance on the previous decision.
The goal of ethics training isn't to stop the one-in-a-thousand sociopath. It's to interrupt the rationalization process for the 999 ordinary people who are capable of talking themselves into something they'll regret.
Q: What should we actually be auditing?
Relationships, not just transactions.
Start with consulting arrangements. Who in your organization is paying a vendor owned by someone's spouse, sibling, or side business? How long has that relationship been running, and who approved it in the first place?
Then look at approval authority. Who can sign off on a cost increase without a second review? Which vendor invoices sail through because the name's familiar and nobody wants to slow things down?
The Hawaii indictment alleges that one defendant routed about $680,000 to his own consulting business and buried it in contract costs starting in September 2020. That's not sophisticated. It's just bold. And it worked for roughly two years, which tells you something about what wasn't being audited.
Q: How do we get people to actually use the hotline?
Stop calling it a hotline. Start calling it what it is: the safety valve that keeps small problems from becoming federal cases.
People don't report because they're afraid of three things: retaliation, being wrong, and looking like a snitch. Your job is to make all three fears smaller than the fear of doing nothing.
That means visible anti-retaliation safeguards, not just a policy buried in the handbook. It means making clear that good-faith reports are protected even when they turn out to be mistaken. And it means leaders talking openly about the time someone raised a concern and it turned out to be nothing, and thanking them anyway.
The Antitrust Division's Speak-Up Program now pays 15 to 30 percent of recoveries in cases producing at least $1 million in criminal fines. That's not a moral appeal. That's the government putting a price on silence, and the price is going up. Internal reporting channels need to compete with that.
Q: What do we do if we find something?
Call the Inspector General. That's not optional advice, it's a requirement under FAR 52.203-13 when you have credible evidence of a violation of federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations under Title 18.
But before you get there, secure the records. Don't confront the person. Don't try to investigate it yourself unless you've got trained investigators and legal counsel in the room. And don't delete anything. Spoliation turns a bad day into a catastrophic one.
Where to Go Next
The Procurement Collusion Strike Force exists because good intentions don't catch schemes like this. People do. People who notice the consulting arrangement that doesn't quite add up. People who ask why one person insists on handling every invoice. People who pick up the phone.
If your ethics program hasn't been updated since the last audit, update it. If your training still opens with "here are the rules and here's what happens if you break them," rewrite it. And if you can't name the three people in your organization who could commit fraud tomorrow without tripping a single control, you've just identified your afternoon project.
The campus in Hawaii was supposed to test the future. It ended up testing something much older: whether ordinary people, given need and opportunity and a story that makes sense, will do the thing they know they shouldn't.
Your program needs to answer that question before someone else does.
