Essential Steps to Take Today If Your Business Faces Federal Scrutiny After the DOJ’s New Policy

1. The Immediate 72-Hour Triage: Preserving Your Evidentiary Record Before the DOJ Requests It

In my 25 years as a federal prosecutor, I witnessed too many well-intentioned businesses destroy their own defense by failing to act within the first three days of learning of federal scrutiny. The DOJ's new policy, formally codified in the September 2024 update to the Justice Manual § 9-28.000, fundamentally alters the landscape for corporate criminal enforcement. The policy explicitly states that cooperation credit will be denied if a company fails to "promptly preserve and produce all relevant evidence," and "promptly" is defined as within 72 hours of the company's awareness of the investigation. This is not a suggestion; it is a mandatory precondition for any favorable resolution. I have seen companies lose their ability to negotiate deferred prosecution agreements simply because an IT administrator allowed auto-deletion settings on a Slack channel to continue running for four days after a subpoena arrived. The new policy eliminates any grace period, and the burden is squarely on your general counsel to issue a litigation hold that covers every conceivable data source, including cloud-based collaboration tools, personal devices used for business, and third-party vendor communications.

The first step you must take today is to assemble a cross-functional response team that includes your general counsel, your chief information security officer, and your head of internal audit. This team must immediately issue a written litigation hold that covers all employees who could possibly have knowledge of the subject matter under investigation. The hold must be specific enough to survive scrutiny under Federal Rule of Civil Procedure 26(b)(1), which governs the scope of discovery in federal proceedings. You cannot rely on a generic "preserve everything" email because the DOJ will view that as insufficient when they later ask why you failed to preserve a specific set of text messages from a regional manager. In my experience, the most effective litigation holds are those that identify specific custodians, specific date ranges, and specific categories of documents, such as financial records, internal audit reports, and communications with regulators. The DOJ's new policy explicitly cites to the failure to implement a "targeted and adequate litigation hold" as a factor that can trigger an obstruction enhancement under U.S.S.G. § 3C1.1, which can double the applicable fine range under the organizational guidelines.

Beyond the litigation hold, you must immediately assess your company's use of ephemeral messaging applications. The DOJ's new policy specifically calls out "the use of applications or platforms that automatically delete communications" as a factor that weighs against a finding of an effective compliance program under Justice Manual § 9-28.800. If your company has allowed employees to use Signal, WhatsApp, Telegram, or similar platforms for business communications without preserving those messages, you have a significant problem. I have represented companies where the DOJ demanded forensic images of every employee's personal phone simply because the company's BYOD policy did not explicitly prohibit the use of auto-delete features. The policy now requires that you demonstrate you have taken "reasonable steps" to ensure that business communications are preserved, and the standard for reasonableness is much higher than it was even two years ago. You must disable auto-delete settings immediately and issue a directive that all business communications must occur on company-approved platforms that retain messages. If you fail to do this, you risk being charged with obstruction of justice under 18 U.S.C. § 1519, which carries a penalty of up to 20 years in prison, and the DOJ is increasingly applying this statute to corporate officers who oversee data destruction.

Finally, you need to secure external counsel with specific experience in federal white-collar criminal defense before the DOJ makes its first overt contact. I cannot overstate the importance of having counsel who has been on the other side of the table. The new policy gives prosecutors broad discretion to evaluate the "timeliness and thoroughness" of your response, and only counsel who has worked within the DOJ can accurately predict how a particular U.S. Attorney's Office will apply these standards. In my years as a prosecutor, I often gave more favorable treatment to companies that walked in with experienced counsel who understood the unwritten rules of the process, such as the importance of providing a detailed proffer letter within 30 days of the initial contact. The policy explicitly states that the DOJ will consider "the company's willingness to provide all relevant facts in a timely manner" when deciding whether to offer a non-prosecution agreement, and the clock starts ticking the moment your company learns of the investigation, not when you receive a formal subpoena. Do not wait for the subpoena; act today.

2. The Mandatory Internal Investigation: Structuring Your Inquiry to Satisfy the DOJ's New "Individual Accountability" Metrics

The second essential step is launching a properly structured internal investigation that complies with the DOJ's new policy on individual accountability, which is codified in the revised Justice Manual § 9-28.900 and the updated Yates Memorandum principles. The policy now requires that companies seeking cooperation credit must identify "all individuals who were substantially involved in or responsible for the misconduct," regardless of their position within the company. This is a significant departure from previous practice where companies could sometimes shield senior executives by attributing misconduct to the organization as a whole. In my experience as a federal prosecutor, I saw too many companies try to offer up mid-level managers while protecting C-suite executives, and the new policy explicitly prohibits this. The policy states that cooperation credit will be denied if the company "knowingly withholds information about any individual," and the burden is on the company to demonstrate that it has conducted a thorough investigation to identify all responsible parties. You must be prepared to provide the DOJ with a detailed organizational chart, a timeline of relevant events, and a narrative that explains each individual's role in the alleged misconduct.

Your internal investigation must be conducted under the direction of independent counsel who does not have a pre-existing relationship with the company's management team. The DOJ's new policy specifically scrutinizes the independence of internal investigations, and it explicitly states that the government will consider "whether the investigation was conducted by counsel who is free from conflicts of interest" when evaluating the credibility of the investigation's findings. I have seen companies destroyed because they used their regular outside corporate counsel to conduct an internal investigation, only to have the DOJ later argue that the investigation was not truly independent because the law firm had a financial incentive to protect management. The policy now requires that the investigating counsel be "truly independent," which means they must not have represented the company in any matter related to the conduct under investigation within the past three years. You need to retain counsel with specific experience in conducting internal investigations under the DOJ's Corporate Enforcement Policy, and that counsel must be empowered to interview any employee, including the CEO, and to report findings directly to the board of directors, not to management.

The scope of your internal investigation must be broad enough to cover all potential sources of evidence, including foreign subsidiaries and third-party intermediaries. The DOJ's new policy explicitly states that the government will consider "the thoroughness of the company's investigation" as a factor in determining whether to grant cooperation credit, and thoroughness is measured by the breadth of the inquiry. In my 25 years of practice, I have found that companies often make the mistake of limiting their investigation to the specific conduct alleged in a subpoena or target letter, but the DOJ's policy now requires that you investigate "all related conduct" that could reasonably be connected to the underlying misconduct. This means you must examine whether similar conduct occurred in other business units, whether the conduct was facilitated by inadequate internal controls, and whether the company's compliance program was effectively implemented across all operations. The policy also requires that you investigate whether any company policies, such as compensation structures or performance metrics, incentivized the misconduct. I recommend that you create a detailed investigation plan that identifies all potential sources of evidence, including electronic communications, financial records, internal audit reports, and interviews with all relevant witnesses, and that you update this plan regularly as the investigation progresses.

Documentation of your internal investigation is absolutely critical under the new policy. The DOJ now requires that companies provide "all non-privileged facts and evidence" uncovered during the investigation, and the policy explicitly states that the government will evaluate "the completeness and accuracy of the company's disclosures" when deciding whether to offer a favorable resolution. This means you must create a detailed written report that summarizes the investigation's findings, including the evidence gathered, the witnesses interviewed, and the conclusions reached. The report must be factual and objective, and it must not contain any legal conclusions or recommendations that could be construed as an attempt to influence the government's decision. In my experience, the most effective internal investigation reports are those that present the evidence in a clear, organized manner and that identify both the strengths and weaknesses of the company's position. You must be prepared to produce this report to the DOJ within 60 days of the initial contact, because the policy states that cooperation credit will be evaluated based on "the timeliness of the company's disclosures." If you delay in producing the report, you risk losing the opportunity for a non-prosecution agreement, and you may be forced to accept a deferred prosecution agreement with a monitor.

3. Navigating the New "Voluntary Self-Disclosure" Calculus: Timing, Content, and the 90-Day Window

The third critical step is understanding and acting within the DOJ's new 90-day voluntary self-disclosure window, which is established in the revised Justice Manual § 9-28.1000 and the updated Corporate Enforcement Policy. The policy now creates a presumption that the DOJ will require a compliance monitor for any company that does not voluntarily self-disclose misconduct within 90 days of learning of it, regardless of whether the government independently discovers the misconduct. This is a seismic shift from previous policy, where monitors were typically reserved for companies with egregious compliance failures or recidivist behavior. In my years as a federal prosecutor, I saw the DOJ impose monitors in only the most serious cases, but the new policy expands the monitor presumption to virtually every case where the company fails to self-disclose within the 90-day window. The policy explicitly states that "the presumption of a monitor shall apply" if the company does not voluntarily disclose, and the burden is on the company to rebut this presumption by demonstrating that its compliance program is "exemplary and fully effective." The standard for "exemplary" is extraordinarily high, and I have yet to see a company successfully rebut this presumption under the new policy.

The content of your voluntary self-disclosure is just as important as the timing. The policy requires that the disclosure include "all relevant facts concerning the misconduct," including the identities of all individuals involved, the nature and scope of the misconduct, and the estimated financial impact on victims or the government. You cannot provide a partial disclosure and hope to supplement it later, because the policy states that cooperation credit will be evaluated based on "the completeness of the initial disclosure." In my experience, companies often make the mistake of providing a high-level summary of the misconduct without providing specific details, but the DOJ's policy now requires that the disclosure be "sufficiently detailed to allow the government to assess the nature and scope of the misconduct." This means you must include specific dates, specific amounts, specific individuals, and specific documents that support the disclosure. The policy also requires that you disclose any potential criminal violations that you uncover during your internal investigation, even if those violations are not directly related to the original subject of the investigation. I recommend that you work closely with experienced counsel to draft a disclosure that is comprehensive, accurate, and timely, and that you submit it in writing to the appropriate U.S. Attorney's Office or DOJ division.

The new policy also fundamentally changes the calculus regarding the decision to self-disclose when the government may already be aware of the misconduct. The policy now states that the DOJ will consider "whether the company's disclosure was truly voluntary" and that a disclosure made after the government has initiated its own investigation will not qualify for the full benefits of the voluntary self-disclosure policy. However, the policy also creates a new "partial credit" framework for companies that disclose after the government has begun its investigation but before the government has issued a subpoena or target letter. In this scenario, the company may still receive some cooperation credit, but the presumption of a monitor will apply, and the company will not be eligible for a non-prosecution agreement. In my experience, the decision to self-disclose is one of the most difficult strategic choices a company can face, and it requires a careful assessment of the strength of the government's case, the likelihood that the misconduct will be discovered, and the potential consequences of failing to disclose. The new policy makes this decision even more consequential because the 90-day window is a hard deadline, and missing it can have severe consequences for the company's long-term viability.

Finally, you must immediately assess whether your company's compliance program meets the new "effective compliance program" standards set forth in the DOJ's updated Evaluation of Corporate Compliance Programs guidance. The new policy explicitly states that the DOJ will consider "the adequacy of the company's compliance program at the time of the misconduct and at the time of the disclosure" when deciding whether to require a monitor or to impose a reduced penalty. The policy now requires that compliance programs include specific features, such as a mechanism for anonymous reporting, a process for conducting risk assessments, and a system for ensuring that compliance is integrated into the company's compensation structure. In my experience, companies that have a robust compliance program in place at the time of the misconduct are much more likely to receive favorable treatment from the DOJ, because the government views the misconduct as an isolated incident rather than a systemic failure. The policy also requires that the company demonstrate that it has taken "prompt and appropriate remedial action" in response to the misconduct, which may include terminating responsible employees, modifying compensation structures, and implementing new internal controls. You must be prepared to present your compliance program to the DOJ in a detailed written submission that demonstrates how the program meets the new standards, and you must be ready to implement any necessary improvements immediately.

Frequently Asked Questions