The Department of Justice Introduces Department-Wide Corporate Enforcement Policy

At a Glance

• Legal and compliance teams should revisit how the company evaluates potential disclosure decisions and ensure decision-makers understand the DOJ’s incentives.
• Prompt and credible responses to internal reports can help ensure that potential issues are identified internally before they reach regulators, and is a condition precedent to credit in certain instances.
• Directors should understand the evolving enforcement landscape and the strategic considerations that may arise when misconduct is discovered, including devoting appropriate resources to the teams that should be positioned to respond quickly to potential misconduct and the disclosure determination.

The US Department of Justice (DOJ or Department) recently announced what it describes as the first Department-wide corporate enforcement policy governing criminal cases. The initiative is intended to standardize how prosecutors across DOJ components — such as US Attorney’s Offices, the Criminal Division, and the National Security Division — evaluate corporate misconduct and determine whether companies receive credit for voluntary disclosure, cooperation, and remediation.

For corporate leaders, the new policy is less about a dramatic shift in enforcement philosophy and more an effort at greater clarity and consistency, as well as clearer incentives, related to how companies respond when misconduct surfaces. By consolidating prior guidance into a single framework, the Department is attempting to make the consequences of corporate decisions more predictable.

The New Policy: Reinforcing DOJ’s Incentives for Corporate Self-Reporting

At the center of the new policy is a familiar message: companies that identify misconduct, report it promptly, cooperate with investigators, and remediate effectively will be treated more favorably. Specifically, the Department’s policy advises that it will decline to prosecute a company for criminal conduct when the following four factors are met:

1. Voluntary self-disclosure to an appropriate DOJ component
2. Full cooperation with the investigation
3. Timely and appropriate remediation of the conduct
4. No aggravating circumstances related to the misconduct or reflective of recidivism exist.

Even when a declination is not appropriate, the policy mandates a nonprosecution agreement, no independent compliance monitor, and substantial fine reductions for companies that attempt to meet the four factors above, but either do not meet the definition of “voluntary self-disclosure” (typically because the conduct is already known to the DOJ) or aggravating factors warrant a criminal prosecution. Finally, prosecutors retain discretion to determine appropriate resolutions over form, term length, and other factors in other cases where a company attempts to cooperate but does not meet the above standards. A copy of a flowchart produced by the DOJ that reflects the new policy is attached at the end of this alert.

The practical effect is to reinforce the DOJ’s goal of encouraging companies to bring misconduct to the government before prosecutors discover it independently.

A Move toward Consistency among DOJ Components

Historically, different components of the Department, including Main Justice divisions and individual US Attorneys’ Offices, developed their own voluntary disclosure policies. Indeed, shortly before this announcement, the Southern District of New York announced a new voluntary disclosure policy unique to that office. While those policies generally emphasized similar principles, the lack of a uniform approach sometimes created uncertainty about how disclosure decisions would be evaluated.

The new policy seeks to address that issue by applying a uniform baseline for corporate criminal enforcement across the DOJ. Prosecutors throughout the Department are now expected to apply the same core framework when determining how companies are treated in criminal investigations. Although not explicitly stated, the existing office-specific policies are now presumably superseded, or at least subordinate to, this Department-wide policy wherever they conflict.

From a corporate perspective, this development may make disclosure decisions somewhat more predictable, particularly for companies operating in multiple jurisdictions.

Actual Cooperation and Remediation Remain Key to a Favorable Outcome

The new policy also indicates that voluntary disclosure alone is not sufficient. Companies seeking favorable treatment must show a significant commitment to cooperation and reform. In evaluating corporate conduct, prosecutors will continue to assess:

• Whether the company provided relevant information about individual misconduct
• The speed and completeness of the company’s cooperation
• The strength of remedial measures, including improvements to compliance programs
• Whether responsible individuals were disciplined or removed

These factors will affect both the level of penalty reductions and the need for an independent compliance monitor.

Continued Focus on Individual Accountability

Consistent with prior DOJ policy, the Department continues to state that corporate cooperation must include identifying individuals responsible for wrongdoing. Companies that wish to receive full cooperation credit are expected to provide all relevant facts relating to the individuals involved in the misconduct. As in prior DOJ guidance, individual accountability is still a core objective of corporate enforcement policy.

What the Policy Means for Corporate Risk Management

The new DOJ policy carries several practical implications for companies.

1. The window for voluntary disclosure may remain narrow and investigations must be structured for speed.

Because the greatest benefits of the policy are tied to voluntary disclosure before the government learns of the misconduct (with some new, but limited exceptions), timing is critical. Companies that take too long to investigate and make the understandably difficult decision of whether or not to disclose may lose the opportunity to obtain maximum cooperation credit.

In many organizations, internal investigations historically progressed cautiously to fully develop the facts before making disclosure decisions. Under the new policy environment, companies may need to adopt investigation protocols that allow for earlier engagement with enforcement authorities when appropriate. That does not mean companies should disclose prematurely, but it does mean that companies must be prepared to evaluate disclosure options quickly, strategically, and sometimes even before they know all the underlying facts at issue. Gaining a reasonable level of comfort that the company understands what went wrong, why it went wrong, and the scope of the misconduct at an early stage will be critical.

2. Compliance programs will continue to be a critical factor.

The policy also highlights the continued importance of effective compliance infrastructure. When determining whether a company deserves favorable treatment, prosecutors will look closely at whether the company:

• Maintained a credible compliance program at the time of the misconduct
• Took meaningful remedial steps after the misconduct was identified
• Implemented reforms designed to prevent recurrence

Companies that can demonstrate serious investment in compliance and remediation will remain better positioned to obtain favorable outcomes.

3. The handling of whistleblowers is important, and not a bar to credit.

The disclosure calculus is also shaped by broader enforcement developments, including DOJ initiatives designed to incentivize whistleblowers and individuals to report misconduct directly to the government. Those incentives increase the possibility that regulators will learn about potential misconduct from sources outside the company. As a result, organizations may have a limited window to identify and disclose issues before they reach enforcement authorities through other channels. Importantly, however, the new policy provides an “exception” that permits voluntary self-disclosure credit even where a whistleblower has reported the conduct first, provided certain timing (less than 120 days after receiving the whistleblower report) and other factors are met.

Steps Companies Should Consider Now

In light of the Department’s new policy framework, companies may wish to revisit several aspects of their compliance and investigation processes.

1. Evaluate internal investigation procedures.

Organizations should ensure that potential misconduct can be assessed quickly and escalated to senior leadership and the board when necessary.

2. Review voluntary disclosure decision frameworks.

Legal and compliance teams should revisit how the company evaluates potential disclosure decisions and ensure decision-makers understand the DOJ’s incentives.

3. Reassess compliance program effectiveness.

Companies should periodically stress-test their compliance programs to ensure they are appropriately designed, resourced, empowered, and changed based on gaps or prior issues.

4. Strengthen whistleblower response mechanisms.

Prompt and credible responses to internal reports can help ensure that potential issues are identified internally before they reach regulators, and is a condition precedent to credit in certain instances.

5. Engage the board in enforcement readiness.

Directors should understand the evolving enforcement landscape and the strategic considerations that may arise when misconduct is discovered, including devoting appropriate resources to the teams that should be positioned to respond quickly to potential misconduct and the disclosure determination.

A Flowchart Produced by the DOJ That Reflects the New Policy