Regulatory, Compliance, and Ethical Considerations
Regulatory, compliance, and ethical considerations
This domain tests whether you know which rules apply, where programs are legally vulnerable, and how to spot fraud. Programs that ignore the legal frame create both contractual and reputational risk.
The US regulatory map
- Small business: SBA size standards by NAICS code, the 8(a) Business Development program, HUBZone, and service-disabled veteran-owned programs, governed by 13 CFR parts 121 and 124 and FAR Part 19.
- Federal subcontracting: FAR 52.219-9 plans and eSRS reporting.
- Federally funded transportation: the DOT DBE program under 49 CFR Part 26, including the commercially useful function test - the DBE must perform a distinct, meaningful part of the work and manage its own performance.
- Constitutional limits: race-conscious measures face strict scrutiny after City of Richmond v. J.A. Croson; programs need documented compelling interest and narrow tailoring, which is why many public programs are race-neutral or evidence-based.
- Other jurisdictions: the UK's social value obligations in public procurement and South Africa's B-BBEE scorecard use entirely different definitions. Never import one framework into another.
Ethics and fraud signals
Front companies, brokers that rent a certification, ownership that exists only on paper, and firms that never control their own operations. Red flags: shared addresses with the prime, the prime directing the certified firm's staff, no independent banking or payroll, and invoicing that flows straight through.
Worked example
A certified firm wins a $2M subcontract, but the prime performs all supervision, supplies the equipment, and directs the certified firm's employees. Invoices show a 4% mark-up and no labor. Under a commercially useful function analysis this is a pass-through, not a valid subcontract. The correct response is to stop counting the spend, document the finding, and review the prime's other reported subcontracts.
Traps
- Treating goals as quotas; most programs require good-faith effort, not a guaranteed award.
- Assuming certification equals compliance with performance rules.
- Applying one certifying body's definition to another program's reporting.
- Missing the recertification that keeps a supplier's status valid.