OCI in Government Contracting: Types, Mitigation, and FAR Changes

Castro & Company (B-423689)

GAO sustained a protest where the agency inadequately evaluated and documented an impaired objectivity OCI. The decision emphasized that contracting officers must perform and document meaningful, fact-based investigations—firewalls aimed at unequal access will not cure impaired objectivity.

Lesson: Provide "hard facts" and practicable mitigations, and ensure the record demonstrates how your measures address the precise OCI type alleged. (Source)

emissary LLC (B-422388.3 et al.)

GAO sustained in part when the agency failed to consider how an OCI mitigation plan materially altered the awardee's technical approach. If mitigation changes labor mix, access, or decision rights, the agency must evaluate the revised technical approach accordingly.

Lesson: Anticipate this scrutiny and align mitigation with a coherent, evaluable approach in the proposal. (Source)

Conflict Mapping

Identify roles, relationships, affiliates, and prior work that may create unequal access, biased ground rules, or impaired objectivity. Use a visual map and narrative that ties each risk to a specific control.

Segregation of Duties

Establish separate capture, proposal, and performance teams where needed. Document reporting lines and decision rights so evaluators can see objectivity is preserved.

Firewalls and Access Controls

Implement technical and administrative barriers (role-based access, separate networks or repositories, need-to-know lists). Address how you prevent unequal access to nonpublic information.

Nondisclosure Regimes

Require NDAs tailored to the procurement. Include periodic training and auditable acknowledgments for anyone with potential exposure to sensitive data.

Informed Consent and Disclosure

Proactively disclose relationships, prior work, team composition, and subcontractor ties that could present OCI. Reference the specific solicitation provisions or clauses proposed in the FAR overhaul where applicable.

Future Work Restrictions

Where appropriate, propose voluntary limitations (e.g., avoiding downstream design or evaluation roles) and show how you will enforce them contractually across affiliates.

Independent Review

Engage an independent ethics officer or outside counsel to review mitigation, monitor compliance, and issue periodic certifications to the CO.

Contemporaneous Documentation

Maintain a detailed log of mitigation decisions, approvals, and training records. GAO decisions repeatedly stress the importance of "show, don't tell" documentation.

Teaming Discipline

Vet partners and subs for potential conflicts early. Where a partner has advisory contracts with the customer, evaluate whether their role might bias ground rules or impair objectivity on the target opportunity.

Solution Shaping with Guardrails

If you offer pre-RFP insights, maintain clear boundaries. Avoid any role that could be seen as drafting requirements tailored to your solution.

Qualification Screening

Address DFARS unique OCI scenarios for defense work; ensure certifications and mitigation plans are ready for NAICS 5416 solicitations as applicable.

Proposal Narrative

Don't assume the agency will infer mitigation. Explain how firewalls operate, who is ring-fenced, and what monitoring you'll perform.

Scenario A: Advisory Contractor Pursuing Implementation Work

Risk: Biased ground rules and impaired objectivity

Exclude personnel who performed policy/advisory roles from capture and performance teams; appoint an independent review board to audit decision artifacts; commit to future work restrictions for evaluation activities; disclose pre-RFP interactions and provide a chronology showing non-tailored input.

Scenario B: Incumbent Evaluator Competing for Follow-On

Risk: Impaired objectivity in evaluating prior work

Separate evaluation and performance teams; use third-party QA oversight; restrict access to prior performance artifacts; propose objective scoring rubrics reviewed by independent personnel; outline phase-in plans that reflect segregation.

Scenario C: Services Contractor with Access to Proprietary Competitor Data

Risk: Unequal access to information

Role-based access, compartmentalized repositories; NDA enforcement and audit trails; designate a compliance officer to monitor access logs and certify no use of nonpublic information in proposal development.