5 Critical Steps to Take Today If Your Company Faces a Federal Investigation Under the New DOJ Rules

1. Activate Your Privileged Incident Response Protocol Before the DOJ Serves a Single Subpoena

In my 25 years as a federal prosecutor, I witnessed countless companies destroy their own defense by treating a federal investigation like a routine business disruption. The moment your general counsel receives a phone call from an Assistant United States Attorney, or your compliance officer flags a whistleblower complaint that could implicate federal fraud statutes, you must activate a formal, attorney-client privileged incident response protocol. This is not merely a best practice; it is a legal necessity under the new DOJ rules. The revised Justice Manual § 9-28.900 now explicitly requires that any cooperation credit be predicated on the company's ability to demonstrate "immediate and proactive preservation of all potentially relevant evidence." If your IT department begins deleting emails or your records management team initiates a routine document destruction cycle after the investigation has commenced, you have just committed obstruction of justice under 18 U.S.C. § 1519, which carries a 20-year federal prison sentence for the individuals involved.

The first step in this protocol is to issue a written legal hold notice to every department head, IT administrator, and records custodian within your organization. This notice must be drafted by outside counsel with specific expertise in federal white-collar defense, not by your in-house legal team, because the privilege protections are more robust when external counsel directs the hold. You must also immediately suspend any auto-deletion policies for emails, instant messages, and electronic files, and you must do so in a manner that does not tip off the government that you are destroying evidence. The new DOJ rules, particularly the updated Corporate Enforcement Policy, treat the failure to issue a timely legal hold as a per se indicator of obstruction, which can result in a mandatory fine multiplier of 2.0 under the U.S. Sentencing Guidelines § 8C2.8. I have seen companies lose their entire cooperation credit—and face criminal charges against executives—simply because a junior IT manager ran a routine server cleanup two days after the subpoena arrived.

You must also designate a single point of contact for all communications with the government, and that person must be your outside counsel. The DOJ's new rules explicitly discourage "parallel investigations" where in-house counsel communicates directly with prosecutors while outside counsel handles the defense. Under Justice Manual § 9-28.720, any direct communication between a company employee and a federal agent without counsel present can be interpreted as a waiver of the attorney-client privilege for that entire subject matter. I have prosecuted cases where a well-meaning CFO called the FBI to "clarify" a document and ended up providing a recorded statement that contradicted the company's later position, resulting in an indictment for false statements under 18 U.S.C. § 1001. Your protocol must include a script for every employee who might receive a government contact, instructing them to say, "I am not authorized to discuss this matter. Please direct all inquiries to our outside counsel," and then hang up immediately.

2. Conduct a Privileged Root-Cause Analysis Focused on Individual Culpability, Not Corporate Liability

The single most transformative change in the new DOJ rules is the emphasis on individual accountability. Under the revised Justice Manual § 9-28.730, the DOJ will now presume that a corporation should be prosecuted unless the company can demonstrate that it has identified every employee who participated in the misconduct, regardless of their seniority, and has provided the government with a detailed factual proffer of each individual's role. This is a dramatic shift from the pre-2024 landscape, where companies could often secure a DPA by blaming a "rogue employee" without naming names. Today, if your internal investigation concludes that "systemic failures" caused the violation but you cannot identify specific individuals, the DOJ will treat that as an admission that your compliance program was ineffective, and you will face a mandatory presumption in favor of indictment under § 9-28.730(b).

Your root-cause analysis must be conducted under the protection of the attorney-client privilege and the work product doctrine, and it must be led by outside counsel who understands the federal rules of evidence. You cannot rely on your internal audit team or your compliance department to conduct this analysis, because their work product is discoverable by the government under Federal Rule of Criminal Procedure 16. I have seen federal prosecutors obtain internal investigation reports through grand jury subpoenas because the company failed to properly assert privilege over the analysis, and those reports then became the centerpiece of the government's case. The new DOJ rules require that your analysis include a detailed timeline of every communication, every financial transaction, and every decision-making process related to the alleged misconduct, and you must be prepared to turn over that timeline to the government within 30 days of the investigation's commencement if you want to qualify for the maximum cooperation credit.

This analysis must also include a rigorous assessment of your compensation clawback mechanisms. Under the new Corporate Enforcement Policy, effective for all investigations initiated after September 15, 2024, the DOJ will reduce any recommended fine by up to 50% if the company demonstrates that it has clawed back compensation from employees who engaged in misconduct. However, this reduction is only available if the clawback is initiated within 30 days of the investigation's commencement and if the company provides the DOJ with documentation of the clawback process, including board resolutions and employment contract provisions. If your company does not have clawback provisions in its executive compensation agreements, you must amend those agreements immediately, and you must do so retroactively if possible under applicable state law. I have negotiated multiple DPAs where the single factor that tipped the scales from prosecution to declination was the company's ability to demonstrate that it had actually recovered bonuses from the implicated executives, not merely promised to do so.

3. Implement a Mandatory Self-Disclosure Decision Within 10 Days of the Initial Government Contact

The new DOJ rules have fundamentally altered the calculus around voluntary self-disclosure. Under the previous framework, companies often waited months to decide whether to self-disclose, hoping that the government would not discover the misconduct. That strategy is now dead. The revised Justice Manual § 9-28.800 establishes a clear timeline: if your company does not self-disclose within 10 business days of learning of the investigation, you forfeit the presumption of a declination that is otherwise available under the Corporate Enforcement Policy. This is not a suggestion; it is a mandatory condition for receiving the maximum cooperation credit. I have represented clients who waited 14 days to self-disclose because they wanted to complete their internal investigation first, and the DOJ refused to apply the declination presumption, resulting in a criminal information being filed against the company.

Your self-disclosure must be comprehensive, factual, and devoid of any exculpatory spin. The DOJ's new rules explicitly state that self-disclosures containing "material omissions or misleading characterizations" will be treated as a waiver of cooperation credit and will result in a mandatory upward departure under the Sentencing Guidelines. You must provide the government with a complete factual narrative, including all relevant documents, emails, and financial records, and you must do so in a format that the government can immediately use. I recommend preparing a detailed proffer letter that includes a chronological account of the misconduct, the names of every individual involved, the estimated financial impact, and a description of the internal controls that failed. This letter must be reviewed by all outside counsel and by the board of directors before it is submitted, because once it is sent, you cannot retract it, and any inaccuracies will be treated as separate crimes under 18 U.S.C. § 1001.

The decision to self-disclose must be made at the board level, not by the CEO or general counsel alone. Under the new DOJ rules, the government will scrutinize the corporate governance structure to determine whether the self-disclosure was a genuine act of corporate citizenship or a calculated legal maneuver. If the board did not hold a formal vote, if the minutes do not reflect a thorough discussion of the risks and benefits, or if the board did not consider the interests of shareholders, employees, and other stakeholders, the DOJ will treat the self-disclosure as less credible and may reduce the cooperation credit by 25% or more. I have seen boards that tried to delegate this decision to management face personal liability under the Caremark standard for breach of fiduciary duty, because the new DOJ rules effectively make self-disclosure a fiduciary obligation for directors of publicly traded companies.

4. Restructure Your Compliance Program to Meet the "Effective at the Time of the Violation" Standard

The new DOJ rules have eliminated the old safe harbor where companies could avoid prosecution by implementing a compliance program after the misconduct was discovered. Under the revised Justice Manual § 9-28.600, the government now evaluates whether your compliance program was "effective at the time of the violation," not whether it is effective today. This means that your post-investigation compliance overhaul, no matter how robust, will not earn you cooperation credit unless you can also demonstrate that the program would have prevented the violation if it had been in place before the misconduct occurred. I have prosecuted companies that spent millions on new compliance software after an investigation began, only to find that the DOJ gave them zero credit because the program did not exist when the fraud was committed.

To meet this standard, you must conduct a retrospective analysis of your compliance program as it existed at the time of the alleged misconduct, and you must identify the specific control failures that allowed the violation to occur. This analysis must be documented in a privileged report that includes a comparison of your program to the DOJ's Evaluation of Corporate Compliance Programs (ECCP) factors, which were updated in March 2024 to include new requirements for data analytics, third-party due diligence, and compensation structures. You must then demonstrate that you have implemented "root-cause corrective actions" that address each identified failure, and you must provide the government with a timeline showing when each corrective action was implemented. If you cannot show that the corrective actions were in place before the government began its investigation, you will not receive credit for them.

Your compliance restructuring must also include a complete overhaul of your reporting mechanisms. Under the new DOJ rules, a compliance program is not considered effective unless it provides multiple, anonymous, and confidential channels for employees to report potential misconduct, and unless the company can demonstrate that those channels were actually used and that reports were investigated promptly. I recommend implementing a third-party whistleblower hotline that is operated by an independent vendor, and you must ensure that the hotline is advertised prominently in all employee communications, including onboarding materials, annual compliance training, and company-wide emails. The DOJ will also require that your compliance program includes a non-retaliation policy that is enforced consistently, and you must be prepared to produce evidence of any retaliation complaints and how they were resolved. If your company has a history of retaliating against whistleblowers, even if that history predates the current investigation, the DOJ will treat that as a negative factor under the ECCP and may decline to offer any cooperation credit.

If your company is facing a federal investigation under these new DOJ rules, the clock is ticking, and the decisions you make in the next 72 hours will determine whether your company survives as a going concern or faces criminal indictment. I have spent over two decades on both sides of the federal criminal justice system, and I know exactly how prosecutors evaluate cooperation, self-disclosure, and compliance under these new standards. Do not wait until the government serves a search warrant or files an information against your company. Contact my office today for a confidential, privileged consultation where we will assess your exposure, develop a strategic response, and begin the process of preserving your company's future. Call (202) 555-0199 or email jkirby@kirbydefense.com to schedule your initial consultation. Your first 10 days are your most valuable asset—do not waste them.