The Conventional Wisdom
Compliance officers are rushing to overhaul their programs in response to Colin McDonald's memo outlining 10 factors the National Fraud Division will use when deciding whether to prosecute corporate fraud. The memo lists specific triggers: senior management involvement, financial losses over $25 million, concealment from government agencies, schemes lasting three years or more, and seven other criteria. The conventional response? Map your risk assessment to these 10 factors, create new controls for each one, and present the updated framework to your board as proof you're aligned with DOJ priorities.
It's a tempting narrative. New enforcement memo equals new compliance requirements equals updated program architecture.
Why We Disagree
This reaction misses the fundamental truth about corporate enforcement: the Justice Department's Corporate Enforcement Policy hasn't changed. The three-part test remains identical. Self-disclose misconduct, cooperate with investigators, and remediate the underlying control failures. Do those three things, and you'll receive a declination regardless of whether your fraud involved senior management, crossed multiple districts, or hit any of McDonald's other factors.
McDonald's memo doesn't create new obligations. It clarifies prosecutorial interest areas within fraud cases the government already planned to pursue. You're not suddenly at greater risk because your company operates in multiple U.S. attorney districts or supports taxpayer-funded programs. You were always at risk if you committed fraud in those contexts and failed to self-disclose.
The compliance officer who rewrites their entire risk assessment around these 10 factors is solving the wrong problem. Your job isn't to avoid prosecution by steering clear of McDonald's criteria. Your job is to detect misconduct early enough that self-disclosure remains viable, cooperate effectively when issues surface, and fix the control gaps that allowed the problem to occur.
The Evidence
Consider what the memo actually says about compliance program evaluation. The Corporate Enforcement Section "will have primary responsibility for evaluating a company's compliance with the terms of any corporate criminal resolution" and "will lead the division's work evaluating a company's efforts to implement or enhance its compliance program."
That section has been doing this work for years under its previous name, the Fraud Section. More importantly, McDonald's memo doesn't amend the Justice Department's guidelines for evaluating corporate compliance programs. The evaluation framework you've been working with remains the standard.
The National Fraud Division was established in April to tackle government benefits fraud. McDonald's 10 factors help prosecutors inside that division decide which cases warrant their limited resources. They don't change whether your company should disclose a fraud scheme, how thoroughly you should investigate it, or what remediation looks like.
Think about the factors themselves. "Whether senior management knew about or were involved in the fraud scheme" matters because executive involvement typically indicates broader control failures and cultural problems. But if you discover executive involvement in fraud and self-disclose it, you're still following the Corporate Enforcement Policy. The factor influences DOJ's decision to prosecute absent disclosure; it doesn't create a new compliance standard.
What to Do Instead
Use McDonald's factors as diagnostic questions during investigations, not as risk assessment categories.
When your team uncovers potential fraud, ask: Does this scheme cross multiple U.S. attorney districts? That question tells you how extensive your investigation needs to be. You'll need capabilities to analyze transactions across offices and match hotline reports from different locations describing similar misconduct. If you disclose fraud in one district but investigators later discover related schemes in other districts you didn't know about, you look incompetent. Worse, the government starts wondering whether you have a culture of fraud problem.
Ask: Does this misconduct affect multiple taxpayer-funded programs? Different government programs use different financial procedures. If you discover fraud in one program your company supports, can you investigate other programs using sufficiently robust forensic capabilities? You need that answer before disclosure, not after DOJ investigators find additional fraud schemes you missed.
These aren't new controls mapped to McDonald's memo. They're investigation and escalation procedures you should already have. The memo helps you recognize when a fraud issue requires broader investigation scope before disclosure.
Your conversations with legal counsel, outside advisers, and senior management remain the same: Should we disclose this issue? How much cooperation can and should the company provide? Have we identified the control failure and determined what remediation will prevent recurrence?
McDonald's criteria might help you argue more forcefully for disclosure or greater compliance investment, depending on the fraud issue you've uncovered. But you're still having the argument you always had. The memo changes the supporting evidence, not the fundamental question.
When the Conventional Wisdom IS Right
McDonald's factors do matter for one specific audience: companies that discover fraud and choose not to self-disclose.
If you're advising management on whether to disclose, and the fraud involves senior executives, resulted in losses over $25 million, was concealed from government agencies, lasted three years, crossed multiple districts, affected multiple taxpayer-funded programs, or triggered any of McDonald's other criteria, you now have clearer evidence that the Fraud Division will prioritize prosecution. That's useful information when management is weighing disclosure risks against prosecution risks.
The factors also matter if you're genuinely uncertain whether misconduct constitutes fraud. McDonald's memo clarifies what the Fraud Division considers serious enough to warrant attention. Use that clarity to inform your disclosure analysis.
But for compliance officers building and maintaining programs? The memo confirms what effective compliance has always required: robust investigation capabilities, clear escalation procedures, and the organizational courage to disclose misconduct before the government discovers it independently. Those priorities haven't changed since the Corporate Enforcement Policy was written, and they won't change when the next enforcement memo arrives.
