Rethinking Fraud Prevention
Most compliance teams see fraud prevention as a routine task. You build controls, run annual training, and file attestations. The real work, many believe, starts after a problem is spotted. Then you investigate, remediate, and report. The Department of Justice's (DOJ) enforcement actions seem like something that happens to other companies, those with poor paperwork.
This reactive mindset is now a liability.
The Shift in DOJ Strategy
The DOJ's fraud division is taking a new approach: seizing assets before indictments and seeking harsher sentencing in some fraud cases. They're using their "full arsenal of criminal statutes" to fight fraud.
The key point many miss is that prevention should happen before fraud occurs. If you're waiting for a whistleblower or audit flag, you're already in crisis mode.
Traditionally, compliance programs act as shields when prosecutors come knocking. But pre-indictment asset seizures change this. By then, your ability to defend yourself, maintain operations, or negotiate is already compromised. Your compliance program becomes a historical record, not a defense.
The flaw in conventional wisdom is assuming you'll have time and resources to show your good-faith efforts. Asset seizures remove that assumption.
The DOJ's Message
When the DOJ seizes assets before indictment, they're not waiting for your remediation plan. They're acting on evidence they've gathered, often through channels you didn't control.
The push for harsher penalties indicates dissatisfaction with baseline penalties under the Federal Sentencing Guidelines for Organizations. Your Culpability Score calculations, which assume cooperation and effective compliance programs will reduce exposure, may not offer the protection you expect.
Consider your fraud detection timeline. If the DOJ builds cases substantial enough for pre-indictment seizures, they're finding evidence your systems missed or flagged too late. The gap between fraud occurrence and detection is when prosecutors build their case.
Your internal audit cycle is quarterly. Your transaction monitoring flags anomalies after they've cleared. Hotline reports come in after employees have witnessed enough to report. Meanwhile, the DOJ analyzes patterns, interviews former employees, and reviews communications you may not even know exist.
Proactive Measures
Start by enhancing detection capabilities. Map every fraud risk to a real-time detection mechanism. Not a control that might catch it eventually, but a system that alerts you immediately.
For revenue recognition fraud, use automated flags for contract deviations or early revenue recognition. For procurement fraud, monitor transactions for split purchases, sole-source justifications bypassing competitive bidding, or vendor addresses matching employee addresses. For financial reporting fraud, ensure reconciliation processes can't be overridden by a single approver and review journal entries before closing.
Improve your investigation triage. Fraud allegations shouldn't be treated like policy violations. By the time you've substantiated a fraud claim, the conduct may have been ongoing for months.
Implement a fraud-specific triage protocol. When a hotline report alleges financial manipulation, procurement kickbacks, or books and records violations, respond within days, not weeks. Involve outside counsel immediately, preserve documents before anyone knows an investigation has started, and assess whether self-reporting is necessary.
Test your program against the possibility of losing access to corporate funds. If the DOJ seizes assets, can you still operate your compliance program? Do you have D&O insurance covering defense costs? Have you established document preservation protocols that don't depend on your IT budget? Can your outside counsel continue working if corporate accounts are frozen?
These aren't paranoid questions. They're operational realities for any organization facing pre-indictment asset seizures.
Finally, treat your books and records requirements as fraud prevention infrastructure, not just accounting compliance. Every transaction affecting your financial statements should have a clear business purpose that someone can explain without consulting documentation. If revenue recognition decisions require a lawyer to explain, you've created fraud risk. If expense approvals rely on relationships rather than written justification, you've created fraud risk.
The DOJ's emphasis on using their full arsenal of criminal statutes means they're not limiting themselves to securities fraud or wire fraud. They're looking at false statements, obstruction, and conspiracy. Every gap in your documentation is a potential criminal charge, not just a control weakness.
When Conventional Wisdom Still Applies
A well-documented compliance program still matters when cooperating with prosecutors. The DOJ Criminal Division Guidance on evaluating corporate compliance programs remains relevant. The Seven Elements of an Effective Compliance Program are still the framework prosecutors use to assess your good-faith efforts.
If you discover fraud through your internal systems, investigate thoroughly, remediate quickly, and self-report appropriately, you're building the record that supports cooperation credit. The Federal Sentencing Guidelines for Organizations still reward organizations with effective compliance programs in place before the offense occurred.
The difference is timing and capability. Your program needs to catch fraud early enough that you're controlling the narrative, not responding to a DOJ investigation already underway. Your documentation needs to show that your controls were functioning, not just existing on paper.
In industries with high fraud risk, like financial services, healthcare, government contracting, and pharmaceuticals, the conventional wisdom about annual training and policy updates was never enough. You needed proactive, real-time detection capabilities all along. The DOJ's new approach just makes the cost of not having them much higher.
Your compliance program can't be something you point to after the fact. It must be the system that prevents the fact from occurring in the first place.
