The National Fraud Enforcement Division's October 1, 2023 directive, known as the McDonald memo, outlines 10 factors prosecutors must consider when deciding whether to charge a company. If your organization interacts with federal programs, government procurement, healthcare reimbursement, or international trade, this memo is essential. It signals a strategic enforcement shift requiring immediate reassessment of compliance programs.
This checklist translates those 10 factors into actionable controls. Each item reflects what prosecutors will scrutinize when evaluating your program under the department-wide Corporate Enforcement Policy.
Prerequisites
Before working through this checklist, ensure you have:
- Mapped all federal touchpoints: Document where your organization interacts with federal funds, programs, revenue, or cross-border goods movement. The memo applies by exposure, not industry classification.
- Identified decision authority: Know who can authorize a voluntary disclosure within 120 days of an internal whistleblower report, the window under the Corporate Enforcement Policy before disclosure credit evaporates.
- Established baseline investigation capacity: Your team must investigate serious allegations and reach disclosure decisions quickly, before the DOJ's data analytics or a whistleblower surfaces the same information.
Checklist Items
1. Management knowledge and involvement controls
☐ Your escalation protocols ensure that material misconduct allegations reach senior leadership and the board within defined timeframes (specify days, not "promptly").
☐ You maintain contemporaneous documentation showing when executives learned of potential violations.
☐ Your investigation protocols require interviews with management when schemes involve their business units.
Good looks like: A documented trail showing that your CEO and general counsel received written notification of a healthcare billing anomaly within 48 hours of detection, with board audit committee notification following within one week.
2. Concealment detection mechanisms
☐ Your internal audit program tests for gaps between representations made to government agencies or external auditors and internal records.
☐ Document retention policies prevent selective destruction when investigations commence.
☐ Whistleblower channels operate independently from business unit management.
Good looks like: Quarterly audits that reconcile regulatory filings against source data, with variance investigations documented and elevated to compliance leadership.
3. Duration monitoring for schemes lasting three years or longer
☐ Your transaction monitoring flags patterns that persist across multiple fiscal periods.
☐ Annual compliance certifications require business units to affirmatively represent no ongoing violations, not just absence of new ones.
☐ Control testing cycles are short enough to detect multi-year schemes before they cross the three-year threshold.
Good looks like: Automated alerts when the same billing code exception recurs for 24 consecutive months, triggering mandatory compliance review before reaching the 36-month threshold cited in the memo.
4. Geographic scope tracking for conduct spanning three or more federal districts
☐ Your case management system tags misconduct by location and aggregates related conduct across jurisdictions.
☐ Investigation protocols require checking whether similar issues exist in other regions when problems surface.
☐ Remediation plans address all affected locations simultaneously.
Good looks like: When your Dallas office identifies improper government contract billing, your investigation protocol requires checking Houston, Atlanta, and all other locations within 10 days.
5. Victim and loss quantification for matters affecting 25+ victims or causing $25 million+ in losses
☐ Your incident response procedures include immediate victim identification and loss calculation.
☐ You maintain current contact information for affected parties to support rapid remediation.
☐ Financial impact assessments begin when misconduct is first suspected, not when resolution discussions commence.
Good looks like: Within 72 hours of identifying a potential procurement fraud, you've calculated affected contract values, identified government program offices involved, and estimated financial exposure, even if investigation continues.
6. National security and military readiness assessment
☐ Your risk assessment explicitly identifies products, services, or data that could affect military readiness or national security.
☐ Incident classification protocols flag matters involving defense contracts, critical infrastructure, or classified information for immediate escalation.
☐ You've designated counsel with appropriate clearances to handle sensitive investigations.
Good looks like: A documented risk matrix that categorizes your government contracts by national security sensitivity, with corresponding investigation and disclosure protocols for each tier.
7. Taxpayer-funded program harm evaluation
☐ Your compliance program maps which federal programs your organization participates in (Medicare, Medicaid, federal grants, procurement programs).
☐ Impact assessments quantify potential financial harm to these programs, not just to your organization.
☐ Remediation plans prioritize stopping ongoing harm to federal programs over internal process improvements.
Good looks like: When healthcare billing errors surface, your investigation quantifies improper Medicare payments within two weeks and initiates voluntary refunds before the government requests them.
8. Multi-program impact tracking
☐ Your risk assessment identifies where single control failures could affect multiple federal programs simultaneously.
☐ Investigation scoping automatically checks whether conduct affecting one program also touches others.
☐ Disclosure decisions account for aggregate harm across all affected programs.
Good looks like: Your trade compliance investigation discovers that customs misclassification affected both tariff revenue and export control requirements, and your disclosure addresses both dimensions.
9. Foreign adversary payment screening
☐ Your third-party due diligence specifically screens for connections to designated foreign adversaries.
☐ Payment systems flag transactions to high-risk jurisdictions for compliance review.
☐ Your sanctions compliance program integrates with fraud detection systems.
Good looks like: Automated pre-payment screening that blocks transactions to entities owned by foreign adversary governments, with compliance review required before override.
10. Immigration offense identification
☐ Your I-9 audit program operates independently from HR and reports directly to compliance.
☐ Workforce analytics detect patterns suggesting systematic immigration violations.
☐ Your whistleblower program explicitly lists immigration violations as reportable conduct.
Good looks like: Quarterly I-9 compliance audits conducted by compliance staff, with results reported to the audit committee and documented retention of all findings.
Common Mistakes
Treating thresholds as safe harbors: The memo's specific numbers (three years, three districts, 25 victims, $25 million) indicate what prosecutors consider significant. A 35-month scheme isn't suddenly safe because it hasn't reached 36 months. Use these figures to identify matters requiring immediate escalation, not as minimum enforcement thresholds.
Assuming industry exemption: The memo applies by federal touchpoint, not industry. If you're a technology company that processes Medicare claims, a retailer that imports goods, or a manufacturer with defense contracts, these factors apply to you.
Relying on written policies alone: The memo explicitly directs prosecutors to look beyond documentation to "how a company identifies, escalates, investigates and responds to misconduct." Your processes must work in practice, with evidence they've been tested and refined based on real incidents.
Ignoring the whistleblower race: The National Fraud Enforcement Division will create new whistleblower incentives (details pending). Combined with the division's data analytics capabilities through its National Fraud Detection Center, the government may learn about misconduct before you report it. Voluntary disclosure credit under the Corporate Enforcement Policy requires beating the government to the information.
Next Steps
Within 30 days: Map your federal program exposure against the memo's priority areas (healthcare, government programs and procurement, revenue evasion and trade). Document which of the 10 factors your organization faces elevated risk around.
Within 60 days: Test your escalation and investigation machinery. Simulate a scenario where a whistleblower reports internally and externally simultaneously. Can you investigate and reach a disclosure decision within 120 days?
Within 90 days: Revise your whistleblower program assuming the DOJ will soon offer incentives for external reporting, including to participants in misconduct. Ensure your internal channels offer compelling reasons to report internally first: speed, fairness, protection, and demonstrated responsiveness to past reports.
The memo doesn't create new compliance standards. It clarifies which existing risks prosecutors will prioritize and how they'll evaluate your response. Your program's effectiveness under pressure, not its elegance on paper, determines whether these factors work for you or against you.
