The DOJ's National Fraud Enforcement Division issued a directive on Oct. 1 that changes how corporate fraud cases are prosecuted. The memo lists 10 factors prosecutors must weigh when deciding whether to charge a company, and it routes every corporate case through a new Corporate Enforcement Section. More significantly, it signals that the DOJ is generating leads through data analytics and designing whistleblower incentive programs, meaning you're more likely to lose the race to self-disclose.
If your organization deals with federal programs, government contracts, healthcare reimbursements, or international trade, reassess whether your compliance program can surface problems fast enough to earn voluntary disclosure credit under the Corporate Enforcement Policy.
What You Need Before Starting
Before accelerating disclosure decisions, know what you're working with:
Current escalation pathways: Document how allegations travel from frontline employees to decision-makers. Time each step. Most programs fail here, not because policies don't exist, but because the process is too slow or bureaucratic.
Decision authority: Identify who can authorize a disclosure to DOJ. This person needs to be reachable within hours, not days.
Investigative capacity: Determine whether you can staff an internal investigation on short notice. If you rely entirely on outside counsel, factor in engagement time.
Touchpoint inventory: Map where your organization intersects with federal funds, federal programs, government revenue, or goods entering the U.S. The memo's priority areas are healthcare, government programs and procurement, revenue evasion, and trade (including forced labor and tariffs). Read this by exposure, not industry.
Whistleblower Hotline baseline: Pull metrics on how long it takes from initial report to preliminary assessment. If you don't track this, start now.
Step-by-Step Implementation
1. Redesign Your Escalation Workflow
The Corporate Enforcement Policy gives you 120 days to self-report after an internal whistleblower report, but only if that person also reported to DOJ. If they go straight to the government, you have no window at all.
Action: Create a rapid-escalation protocol for allegations that meet any of these thresholds:
- Conduct lasting three years or longer
- Schemes reaching three or more federal districts
- Harm to 25 or more victims or $25 million in losses
- Involvement of management or concealment from auditors
- Threats to military readiness or harm to taxpayer-funded programs
These aren't safe harbors, but they indicate what the DOJ considers material enough to prioritize.
Implementation: Build a decision tree that routes high-risk allegations directly to your general counsel or chief compliance officer within 24 hours. Bypass standard review layers for matters that touch federal programs or government money.
2. Accelerate Preliminary Assessments
You can't make an informed disclosure decision without understanding what happened. Traditional investigations take weeks to scope.
Action: Develop a 72-hour preliminary assessment protocol. This isn't a full investigation; it's a rapid triage to determine whether you have a disclosure obligation.
Steps:
- Preserve relevant documents and communications immediately
- Interview the complainant and direct witnesses within 48 hours
- Determine whether the alleged conduct falls within the DOJ's priority areas
- Assess whether management was involved or whether anyone concealed information from auditors
- Estimate the duration, geographic scope, and financial impact
Document your preliminary findings in a memo that includes a disclosure recommendation. This memo should reach decision-makers within three days of the initial report.
3. Build Disclosure Decision Criteria
The Corporate Enforcement Policy offers a declination to companies that voluntarily self-disclose, fully cooperate, and timely remediate, absent aggravating circumstances. The McDonald memo tells you what the DOJ considers aggravating.
Action: Create a disclosure decision matrix that weighs:
- Whether you learned about the misconduct before DOJ did (through its data analytics or a direct whistleblower report)
- Whether management knew about or participated in the scheme
- Whether anyone concealed the conduct from government agencies or auditors
- Whether the conduct threatens Americans' safety or security
- Whether it involves federal programs, government procurement, revenue evasion, or international trade
If three or more factors point toward aggravation, presume you need to disclose.
4. Strengthen Your Whistleblower Hotline
The memo directs the division to design policies that encourage whistleblowers to report to DOJ, including whistleblowers who participated in misconduct. You need to create stronger incentives for people to report internally first.
Action:
- Make your Whistleblower Hotline visible. If employees need to search your intranet to find it, it's not accessible enough.
- Guarantee retaliation protection in writing and communicate it repeatedly
- Establish a 48-hour acknowledgment standard for all reports
- Provide status updates to whistleblowers every two weeks during investigations
- Track time-to-resolution and publish anonymized metrics annually
The goal is to make internal reporting faster and more responsive than going to DOJ.
5. Audit Your Remediation of Deficiencies Process
The Corporate Enforcement Policy requires timely remediation. The McDonald memo emphasizes that prosecutors will look beyond written policies to how you actually identify, escalate, investigate, and respond to misconduct.
Action: Review your last three significant compliance issues. For each one:
- How long did it take to identify the problem?
- How long until it reached decision-makers?
- How long until you completed an investigation?
- What remediation did you implement, and how long did that take?
- Can you document that the remediation worked?
If any step took longer than 30 days without documented justification, you have a process problem.
Validation: How to Verify It Works
Run a tabletop exercise with a hypothetical scenario that meets the memo's aggravating factors. Use a realistic allegation: a three-year billing scheme involving federal healthcare programs, with preliminary evidence that a regional manager knew about it.
Start the clock when the "whistleblower" makes an internal report. Track:
- Time to escalation to decision-makers
- Time to preliminary assessment completion
- Time to disclosure decision
- Gaps in documentation or authority
If you can't reach a disclosure decision within seven days, your process isn't fast enough.
Maintenance and Ongoing Tasks
Quarterly: Review Whistleblower Hotline metrics. Track time-to-acknowledgment, time-to-preliminary-assessment, and time-to-resolution. If any metric trends upward, investigate why.
Semi-annually: Update your touchpoint inventory. As your business changes, so does your exposure to federal programs and government money.
Annually: Re-run your tabletop exercise with different scenarios. Rotate the decision-makers who participate so the protocol doesn't depend on one person.
Continuously: Monitor DOJ enforcement actions in your sector. The division is using data analytics to generate leads quickly, which means patterns that previously went unnoticed may now trigger investigations. If you see enforcement activity in adjacent companies, treat it as an early warning.
The fundamentals haven't changed. You still need effective internal controls, escalation, investigation, documentation, and remediation. What's changed is the timeline. The DOJ is getting faster at finding problems, and your compliance program needs to move faster too.
