COR Responsibilities: What Every Contracting Officer's Representative Must Know

You've been designated as a Contracting Officer's Representative (COR). You have a signed appointment letter, a stack of contract documents, and a contractor waiting for direction. If nobody sat you down and walked through what you actually have to do (and what you absolutely cannot do), this guide is for you.

The COR role sits at the intersection of program execution and contracting. Done well, it protects the government's interests, keeps contractors performing, and builds a credible performance record for future awards. Done poorly, it creates unauthorized commitments, payment disputes, and program delays. The good news: the job is learnable and the rules are clear.

For the broader context on how contracts work (types, modifications, source selection), see our Federal Contracting 101 guide.

What Is a COR (and What Isn't)?

A Contracting Officer's Representative is a government employee, civilian or military, designated in writing by the Contracting Officer (CO) to assist in the technical monitoring or administration of a specific contract. That designation is the source of all COR authority, and it's limited by exactly what the CO's letter says.

CORs are described in FAR 1.604. Under FAR 1.602-2(d), the CO must designate a COR on every contract and order that isn't firm-fixed-price (unless the CO keeps the COR duties), and may designate one on firm-fixed-price work when it makes sense. In the FAR overhaul text DoD now uses, the same rules sit in section 1.404. DoD adds its own rules in DFARS and in DoD Instruction 5000.72, the DoD standard for COR certification.

This isn't a technicality. It's a structural feature of federal contracting law. Only holders of a Contracting Officer's warrant can legally bind the government to a contract. CORs are technical experts and program representatives, not contracting officials.

Appointment Authority and the Delegation Letter

CORs are formally designated through a written delegation letter from the CO. This letter is not optional boilerplate. It's the legal document that defines your authorities and responsibilities. Before you do anything as a COR, read your delegation letter carefully.

Your delegation letter should specify:

• The specific contract(s) for which you are designated
• The period of the designation
• Your specific delegated responsibilities (surveillance, invoice review, etc.)
• Any functions expressly not delegated to you
• Training and certification requirements you must meet
• Reporting requirements to the CO

If your delegation letter is vague or incomplete, go back to the CO and get clarity before you start acting. An ambiguous delegation letter that leads to an unauthorized commitment is a problem you don't want.

The 6 Core COR Duties

COR responsibilities vary by contract complexity and program type, but six core duties appear on virtually every COR assignment. Master these and you're doing the job.

1. Contract Surveillance

Your primary job is watching contract performance. Is the contractor doing what the Statement of Work (SOW) or Performance Work Statement (PWS) requires? Meeting schedules? Providing required personnel? Using approved subcontractors? Performing work at the agreed locations and with the agreed methods?

Effective surveillance is systematic, not reactive. You need a Surveillance Plan (sometimes called a Quality Assurance Surveillance Plan, or QASP) that identifies what to monitor, how often, what acceptable performance looks like, and how you'll document findings. The QASP should have been developed during pre-award; if you inherit a contract without one, create one.

Surveillance methods include: on-site observation, review of contractor-submitted reports and data, conversations with the contractor's key personnel, and inspection of deliverables. Document everything. A COR file with no surveillance records is useless when a contractor dispute or protest arises.

2. Deliverables Review and Acceptance

The contract specifies what deliverables the contractor must provide (reports, data, systems, services) and when. Your job is to receive them, evaluate them against the contract requirements, and either accept them (triggering payment) or reject them (with documented reasons and a cure period).

Be specific in rejections. A vague response like "this report doesn't meet requirements" is not sufficient. A rejection that reads "Section 3.2 of the SOW requires the monthly status report to include [specific content]; the submitted report omits [specific omission]; the contractor has 10 days to resubmit" is a defensible rejection that creates a clear path for both parties.

Don't accept substandard work to avoid conflict. Accepting deficient deliverables sets a precedent, establishes constructive acceptance, and potentially waives the government's right to enforce those requirements in the future.

3. Invoice Review

On cost-reimbursement and T&M contracts, the COR typically reviews invoices before the CO authorizes payment. This is serious financial oversight. You're checking:

• Are the hours billed consistent with what you observed the contractor performing?
• Are the labor categories invoiced consistent with the staff actually assigned?
• Are material costs supported by receipts and consistent with the contract?
• Is the invoice within the funding available on the contract?
• Does the invoice comply with the contract's billing instructions?

If something looks wrong, don't approve it. Communicate with the CO before the payment clock runs. Under the Prompt Payment Act, the government generally has 30 days to pay a proper invoice and pays interest when it's late. But paying an incorrect invoice because you approved it under time pressure is far worse than a late payment dispute.

4. CPARS: Writing Performance Assessments That Matter

CPARS (Contractor Performance Assessment Reporting System) is the federal government's official system for recording contractor performance evaluations. CPARS ratings follow contractors from contract to contract. They're reviewed during source selections as past performance and can make or break future award decisions.

CPARS evaluations are prepared at least annually and when the work is completed. On many contracts the COR drafts the narrative as the Assessing Official Representative, and the Assessing Official (often the CO) reviews and signs it. Contractors get up to 14 calendar days to submit comments, rebuttals or more information.

The ratings scale runs Exceptional, Very Good, Satisfactory, Marginal, Unsatisfactory, across evaluation areas including Technical (Quality), Schedule, Cost Control, Management, Small Business Subcontracting, and Regulatory Compliance (FAR 42.1503 and the CPARS guidance).

What makes a good CPARS entry:

• Specific facts, not adjectives. "Very responsive" is useless. "Contractor responded to all 14 government requests within the contractually required 48-hour window; average response time was 6 hours" is actionable.
• Documented with your surveillance records. Your CPARS entry should directly reference the observations in your surveillance file. If you haven't been documenting, you can't write a credible CPARS.
• Balanced and honest. If a contractor was excellent on quality but missed three schedule milestones, say both. Inflated CPARS ratings harm future source selections; deflated ratings can generate contractor disputes and legal challenges.

5. COR File Maintenance

FAR 1.604 (section 1.404 in the overhaul text) requires CORs to maintain a file for each assigned contract containing, at minimum, the CO's designation letter and other documents describing your duties, a copy of any contract administration functions delegated to a contract administration office that can't be delegated to you, and documentation of the actions you take. Best practice goes well beyond the minimum.

A complete COR file should include:

• The contract and all modifications
• COR appointment letter
• The Surveillance Plan/QASP
• Surveillance logs and observation records
• Correspondence with the contractor (emails, meeting minutes, technical direction letters)
• Deliverable receipts and acceptance/rejection notices
• Invoice review records and recommendations
• CPARS assessments
• Any issues or concerns communicated to the CO

The COR file is your contemporaneous record of contract performance. In a dispute, a protest, or an audit, the COR file is exhibit A. Rebuild it from memory six months after the fact and it's worthless. Keep it current in real time.

6. Communication with the CO

The CO is your principal. Your job is to be their technical eyes and ears on the contract, not to operate independently. This means proactively communicating:

• Any performance issues, even before they become formal problems
• Contractor requests that could constitute a contract change
• Any situation where you're unsure whether you have authority to act
• Emerging technical scope changes that may require a modification
• Contractor financial distress signals (if visible)

The COR-CO relationship works best when communication is regular and proactive, not crisis-driven. A monthly check-in on contract status is vastly better than a call saying "we have a big problem."

What CORs Cannot Do: The Hard Lines

This is the section that gets CORs in trouble. The restrictions on COR authority exist because the government needs a single, accountable official with contracting authority (the CO), and any erosion of that creates legal and financial chaos. Know these limits cold.

CORs CAN	CORs CANNOT
Observe and document contractor performance	Direct the contractor to perform work not in the contract
Accept or reject deliverables per the contract	Change the scope, schedule, or price of the contract
Review invoices and recommend approval or rejection	Approve or authorize payments themselves
Communicate technical questions and answers to the contractor	Authorize overtime, additional staffing, or accelerated delivery
Draft CPARS assessments for CO review and submission	Issue technical direction that changes contract requirements
Maintain the COR file and surveillance records	Commit the government to any obligation not in the contract
Raise concerns and recommendations to the CO	Negotiate with the contractor on terms, price, or conditions
Issue Technical Direction Letters (TDLs) within scope, if specifically authorized	Issue TDLs that constitute changes to the contract

Unauthorized Commitments: The Worst-Case Scenario

An unauthorized commitment occurs when a government employee who lacks contracting authority directs a contractor to perform work and the contractor does so in reasonable reliance on that direction. The contractor has now done work the government hasn't formally authorized, and may not get paid for it.

For the unauthorized work to be paid, someone with ratification authority has to ratify the commitment. Under FAR 1.602-3 (section 1.405 in the overhaul text), that's the head of the contracting activity or a delegate no lower than the chief of the contracting office. The conditions include: the government received and accepted the supplies or services (or otherwise got the benefit); the contract would have been proper if a CO had awarded it; the price is fair and reasonable; the CO recommends payment and legal counsel concurs; and funds were available at the time. Ratification is discretionary and can be denied.

CORs who create unauthorized commitments face potential personal liability, administrative action, and the loss of their delegation authority. Always route changes through the CO, even when it feels slow.

Training Requirements: FAC-COR and DoD COR Certification

COR certification requirements differ between civilian agencies and DoD.

FAC-COR (Civilian Agencies)

The Federal Acquisition Certification for Contracting Officer's Representatives (FAC-COR) program, managed by the Federal Acquisition Institute (FAI), applies to civilian executive agencies (except DoD). It has three levels:

• FAC-COR Level I: For low-risk contract vehicles, such as supply contracts and orders. 8 hours of training, no experience required.
• FAC-COR Level II: For contracts of moderate to high complexity, supply or service. 40 hours of training plus 1 year of previous COR experience.
• FAC-COR Level III: For the agency's most complex and mission-critical contracts. 60 hours of training plus 2 years of previous COR experience.

To keep the certification current, FAC-COR holders need continuous learning: 8 hours every two years at Level I, and 40 hours every two years at Levels II and III.

DoD COR Requirements (DoDI 5000.72)

DoD CORs don't use FAC-COR. They follow DoD Instruction 5000.72, which sorts CORs into Types A, B and C, with more training and experience expected as a contract's complexity and risk go up. Each type has required courses before designation (from DAU, now WarU) and refresher training every three years: 8 hours for Type A and 16 hours for Types B and C. The 80-hours-every-two-years continuous learning rule you may have heard about belongs to DAWIA acquisition workforce members, and plenty of CORs aren't in that workforce.

The COR Role and Your Career

The COR assignment is underestimated as a career development tool. Done well, it gives you:

• Direct program execution experience: You see how contracts actually perform, not just how they're designed
• CO relationship building: The CO sees your work product; a strong COR reputation opens doors
• CPARS writing proficiency: Critical for anyone in acquisition workforce roles
• Contracting knowledge: Every ambiguous situation teaches you something the FAR training course didn't cover
• Experience that transfers: Hands-on contract management you can point to when you apply for program management or contracting jobs

If you're a Contracting Specialist or Contracting Officer (KO), COR experience on the other side of the desk is invaluable. If you're a program manager, understanding what CORs need to do their jobs effectively makes you a better customer to your contracting office. Either way, this role rewards people who take it seriously.

Frequently Asked Questions

Can a COR be held personally liable for mistakes?

Yes, in certain circumstances. FAR requires your designation letter to state that you may be personally liable for unauthorized acts (FAR 1.602-2(d)(7)). Creating an unauthorized commitment (directing a contractor to perform work you don't have authority to authorize) can result in personal adverse action. This can range from reprimand to removal, depending on the severity and circumstances. Acting within your designated authorities protects you; stepping outside them creates risk.

What's the difference between a COR and a COTR?

The terms are used interchangeably in many agencies. COTR stands for Contracting Officer's Technical Representative, an older term you'll still see in some agencies and older documents. The role, duties, and authorities are functionally identical to COR. DoD standardized on COR terminology, and FAR 1.604 uses COR. If you're designated as a COTR, FAC-COR (civilian agencies) or DoD's COR certification standard still applies; the title is just legacy terminology.

How often must CPARS assessments be submitted?

Interim evaluations are due at least annually, and a final evaluation is due when the work is complete (FAR 42.1502, section 42.1102 in the overhaul text). The CPARS guidance says the whole process should be finished within 120 days after the end of the period being evaluated. The Assessing Official (often the CO) is ultimately responsible for timely submission; the COR's job is to provide the substantive evaluation input. Late or missing CPARS hurt both good contractors (no positive record) and the government (no accurate past performance data for future source selections).

What should I do if the contractor does something the contract doesn't cover?

Stop and call the CO. Do not tell the contractor to proceed, even if the work seems obviously necessary and you want to be helpful. The contractor performing out-of-scope work without a modification creates an unauthorized commitment, and the contractor may not get paid for that work. The right path is: COR documents the situation, notifies the CO, CO determines whether a modification is needed, and the modification is processed before the work proceeds. It's slower, but it protects everyone.

Can a program manager or technical lead serve as a COR without contracting training?

No. FAC-COR and DoD COR requirements mandate completion of specific training courses before designation. A contracting officer cannot appoint someone as a COR who hasn't met the training prerequisites. If a program office wants a particular technical expert to serve as COR, that person needs to complete the required training first. The training exists so a COR knows where their authority stops before they're in a position to cross that line.