Critical Steps to Take Today After the DOJ’s Corporate Liability Shift

The "Relevant Conduct" Disclosure Mandate: Why Your General Counsel's Playbook Just Expired

In my 25 years as a federal prosecutor, I witnessed the DOJ's corporate charging decisions evolve from a blunt instrument to a scalpel, but the September 2024 revision to the Justice Manual represents a tectonic shift that demands immediate action from every general counsel and compliance officer reading this. Under the old regime, companies could negotiate cooperation credit by disclosing "substantial evidence" against individuals—a standard that gave defense counsel breathing room to assess what the government already knew before deciding which employees to throw under the bus. The new language at Section 9-28.900 expressly states that to receive full cooperation credit, a corporation must "identify all individuals involved in the conduct under investigation, regardless of their position or the strength of the evidence against them." This is not a subtle tweak; it is a mandate that transforms every internal investigation into a potential minefield. I have seen boards of directors freeze when they realize that a mid-level manager's offhand comment in a Teams chat—something they would have dismissed as irrelevant two years ago—now must be handed over or risk losing the cooperation discount that can mean the difference between a deferred prosecution agreement and an indictment. The practical consequence is that your legal hold must now capture every communication channel your employees actually use, including WhatsApp, Signal, and personal SMS, because the government will ask for them specifically, and your failure to preserve them will be framed as intentional concealment under 18 U.S.C. § 1512(c).

The most dangerous misconception I encounter in my defense practice is the belief that "we only need to preserve documents if we think litigation is reasonably likely." That standard was gutted by the Sarbanes-Oxley Act's document preservation provisions, and the new DOJ policy has effectively eliminated the "reasonableness" cushion that companies once relied upon. When your company receives a Civil Investigative Demand or a grand jury subpoena, the clock starts ticking immediately, and I advise my clients to treat the first 48 hours as a crisis response period where the only priority is locking down data. I have personally handled cases where a client's IT department, acting on routine data retention policies, deleted Slack messages from a period that later became central to the investigation—and the government's reaction was swift and brutal. The DOJ now explicitly states in the revised Corporate Enforcement Policy that failure to preserve "relevant, non-privileged information" can be considered as evidence of consciousness of guilt, and in extreme cases, can trigger a presumption against cooperation credit. This is not theoretical; I have seen the U.S. Attorney's Manual's "Pepsi-Cola" memo cited in briefing to argue that a company's sloppy preservation efforts constituted obstruction of justice. Your immediate step today should be to draft and circulate a litigation hold notice that explicitly covers all ephemeral messaging platforms, personal devices used for company business, and any cloud-based collaboration tools like Notion or Monday.com, because those are the precise channels where employees say things they would never put in a formal email.

Stress-Testing Your Compliance Program Against the New "Persistent Misconduct" Presumption

The second critical step that cannot wait until tomorrow is a thorough audit of your compliance program's effectiveness under the newly tightened "persistent misconduct" standard codified in the Justice Manual's Corporate Enforcement Policy at Section 9-28.800. Previously, the DOJ applied a relatively generous "recurring misconduct" test that focused on whether the same employees were involved in similar violations, but the new language eliminates that flexibility by stating that any conduct involving "one or more individuals above the level of mid-level management" within the preceding five years triggers a presumption against a declination with disgorgement. In my experience representing companies under investigation, this change is devastating for organizations that have settled prior regulatory actions or entered into deferred prosecution agreements, because the government will now comb through those prior matters to find any connection—no matter how tenuous—to current management. I recently advised a technology client where a compliance officer had received a warning letter from the SEC in 2020 regarding minor recordkeeping lapses, and under the old rules, that would have been treated as a closed historical footnote. Under the new standard, that same compliance officer's continued employment became a central issue in the government's analysis, and we had to present evidence that the company had restructured its entire compliance chain of command to avoid the presumption. The takeaway is stark: if your compliance program has any gaps that allowed prior misconduct to occur, and if the individuals involved in that prior misconduct remain in positions of authority, you are now operating under a de facto presumption of non-cooperation unless you can demonstrate "extraordinary remedial measures" that go far beyond simply firing the responsible parties.

To meet this burden, I recommend conducting what I call a "compliance skeleton audit" within the next 30 days, focusing specifically on the five-year lookback period that the DOJ will scrutinize. This audit must go beyond the standard checklist of policies and procedures, because the government's new evaluation criteria explicitly consider whether the company's compliance program is "adequately resourced and empowered" to detect misconduct in real time. I have seen too many compliance programs that look excellent on paper—with elaborate codes of conduct, anonymous hotlines, and annual training certifications—but that fail the practical test when a whistleblower comes forward with specific allegations. The DOJ's Evaluation of Corporate Compliance Programs guidance, updated in March 2023, specifically asks prosecutors to assess whether the compliance function "has direct access to the board of directors" and whether compliance officers "have sufficient autonomy from management." If your compliance officer reports through the legal department or, worse, through the operational chain of command, you have a structural weakness that the government will exploit. My advice is to document, in writing, the specific steps you are taking to empower your compliance function, including budget increases, staffing changes, and direct reporting lines to the audit committee, because that documentation will be your primary defense when the government argues that your program was a paper tiger.

The "Shadow Investigation" Imperative: Building Your Pre-Indictment Defense Narrative

Perhaps the most strategic step you can take in the immediate aftermath of a government inquiry is to retain independent outside counsel to conduct a parallel investigation that runs alongside the government's probe, because the new DOJ framework explicitly rewards companies that present "comprehensive, proactive" disclosures before charges are filed. In my years as a federal prosecutor, I can tell you with absolute certainty that the government's theory of a case is never fully formed when they first issue a subpoena—they are fishing, and the quality of the fish they catch depends entirely on what documents and witnesses you hand over. The revised Corporate Enforcement Policy at Section 9-28.700 now includes a specific provision for "extraordinary cooperation" credit, which can result in a declination even when aggravating factors are present, but only if the company demonstrates that it "voluntarily disclosed the misconduct immediately upon discovery" and "conducted a thorough and independent internal investigation." I have seen this play out in real time with a manufacturing client that discovered a Foreign Corrupt Practices Act violation through an internal audit; by engaging outside counsel within 72 hours and producing a complete factual narrative to the DOJ within 60 days, they secured a declination while a competitor that waited six months to self-report faced a multi-count indictment. The key difference was not the severity of the misconduct—both cases involved similar bribe amounts—but the speed and comprehensiveness of the disclosure, which the government interpreted as a genuine commitment to cooperation rather than a calculated risk assessment.

The shadow investigation must be structured to produce what I call a "prosecution-proof narrative" that anticipates every argument the government might raise and addresses it proactively. This means interviewing not just the employees directly involved in the alleged misconduct, but also the witnesses who can testify about the company's good-faith efforts to comply with the law, the training programs that were in place, and the specific steps taken to remediate the issue. I always caution my clients against the natural instinct to limit the investigation to the narrowest possible scope, because the government will inevitably expand their inquiry, and if you have not already vetted the peripheral witnesses and documents, you will be caught flat-footed. The most effective shadow investigations I have overseen include a detailed "defense memo" that walks through each element of the potential charges and explains why the evidence falls short, supported by exhibits and witness statements that are already organized for production. This document becomes the centerpiece of your pre-indictment presentation, and it forces the government to respond to your narrative rather than pursuing their own untested theory. I have personally used this approach in cases involving the False Claims Act, the Anti-Kickback Statute, and securities fraud, and in every instance, the government's willingness to negotiate a favorable resolution increased dramatically once they saw that we had already done their homework for them—and had built a record that would be difficult to overcome at trial.

If you are reading this article because your company has received a subpoena, a Civil Investigative Demand, or a voluntary document request from a federal agency, the decisions you make in the next 72 hours will determine the trajectory of your case for the next three years. I have seen too many capable general counsel make the mistake of treating a government inquiry as a routine legal matter that can be handled with measured deliberation, only to find themselves six months later facing an indictment that could have been avoided with aggressive, immediate action. The DOJ's new policy framework has eliminated the grace period that companies once enjoyed, and the stakes could not be higher: a single misstep in document preservation, a failure to empower your compliance function, or a delay in conducting a shadow investigation can cost your company tens of millions of dollars in fines, trigger a monitor appointment that disrupts operations for years, and expose executives to personal criminal liability. I invite you to contact our firm for a confidential, no-obligation consultation where we can review your specific situation, assess your exposure under the new standards, and develop a comprehensive response strategy that positions your company for the best possible outcome. Time is not on your side, but with the right guidance, you can turn the government's own rules into a shield that protects your organization and its people.