Tucked away in the long pages of the National Defense Authorization Act for Fiscal Year 2023 is a provision creating a new notification requirement for offices of inspectors general. This new provision gives NGOs and business entities the right to respond to OIG reports in which they are specifically identified, giving business entities a voice and platform they never had before.
But will businesses take advantage of this unprecedented opportunity? The wise will understand that it is better to have the last word.
Section 5274 of the Act requires the OIG to notify nongovernmental organizations and business entities when an audit, evaluation, inspection, or other non-investigative report prepared by the OIG specifically identifies the entity.
This notification requirement applies regardless of whether the entity is the subject of the report. After notification, the entity has 30 days to submit a written response, which the OIG must attach to the report and post on its public website.
What does this mean
For the first time, business entities have the right to weigh in on how they are named or characterized in an OIG report, and their comments will forever be publicly linked to the report. Any business entity that has been adversely represented in an OIG report will immediately appreciate the significance of the opportunity.
When exercising this newfound right, businesses must be strategic, using the opportunity to craft a written response that serves to advance their business interests. Use these three simple tips when you’re getting started.
Ask questions. Consider contacting the notifying OIG to learn more about its process. The OIG is in various stages of developing policies and procedures to implement the section 5274 notification requirement.
There may not be a consistent approach across federal OIGs. For example, some OIGs may choose to reproduce the entity’s written response in full, while others may choose to summarize the response.
Some may reserve the right to refuse to publish a written response to a subject unless it meets the criteria for such responses. Knowing a particular OIG approach can help an enterprise make intelligent decisions about the form and content of the response.
Read the full report. Important context and related findings can be found in other sections of the report. Reading the entire report is the only way to fully appreciate the potential business, legal and reputational risks posed by identifying an entity in the report.
Be strategic. Set the record straight and influence the narrative. The business must offer any additional factual or contextual information it deems necessary to ensure clarity and completeness.
Entities may refute or reject perceived misstatements in reporting and highlight completed and/or planned corrective actions and other information favorable to the entity. This can help mitigate some of the above risks.
Potential warnings
First, the right of reply provided by section 5274 may be lost if the organization is deemed by the OIG to have refused to provide information or assistance sought by the OIG during the creation of the report. Entities should keep this in mind when evaluating whether and how to respond to requests for information or other requests made by the OIG in connection with an ongoing audit, inspection, or evaluation.
Second, if an entity is specifically identified in a document included or attached to an OIG report, but not in the body of the report itself, many OIGs will not notify the entity if the document was not prepared by or on behalf of the OIG. The OIGs for the Department of Justice and the Department of Education have taken this approach; others may as well.
Section 5274 does not specify how notice must be provided to business entities specifically named in an OIG report. Some OIGs may choose not to send notice directly to the identified entity. Instead, they may post a notice statement on their website when the report is published stating that the report may be subject to section 5274 and detailing the process for providing a written response.
Outlook
Until it is determined whether this is sufficient to satisfy the notification requirement of Section 5274, the entity should consider being proactive in identifying OIG reports that mention it.
This can be done by setting up an internet alert that includes the subject’s name(s) and the phrase “Inspector General”. Taking this simple step also prevents cases where the OIG attempts to provide direct notice to an entity, but the notice is never received due to technical errors, routing errors, or other errors.
Non-governmental organizations and business entities that appreciate the importance of this new right and take advantage of it will enjoy a valuable advantage. Because really, who wouldn’t want the last word?
This article does not necessarily reflect the views of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law and Bloomberg Tax, or its owners.
Information about the author
Diana Shaw is a partner in Wiley’s White Collar Defense and Government Investigations practice.
Write for us: Guidelines for the author
