The new rule requires vendors to set up internal controls, audit their processes for identifying potential violations, create a hotline or other way for employees to anonymously report potential problems, and most controversially, made it mandatory for vendors to report potential violations based on credible evidence.