(I)#
the vendor had, at the time of the violation under paragraph (1), an effective policy and program in effect to prevent violations described in paragraph (1); and
(II)#
the ownership of the vendor was not aware of, did not approve of, and was not involved in the conduct of the violation.