The Justice Department's National Fraud Division has published 10 enforcement factors for corporate prosecutions. Many compliance officers read the memo, nod, and file it away. That's the first mistake.
These aren't just prosecutorial guidelines. They're a specification sheet for what your compliance program needs to detect, investigate, and escalate. If your controls can't surface the patterns these factors describe, you're building a program that looks backward while enforcement moves forward.
Here's why compliance teams keep getting this wrong, and what you need to fix before the next investigation lands on your desk.
Why These Mistakes Keep Happening
Compliance programs evolve slowly. You built your controls around last year's enforcement priorities, last quarter's audit findings, and whatever your peer companies are doing. The Fraud Division's memo represents a shift in what prosecutors will pursue, specifically corporate frauds that cut across multiple U.S. attorney districts. Your existing detective controls weren't designed for that scope.
Another reason: compliance officers treat enforcement memos as legal documents, not operational requirements. You read them for disclosure obligations and cooperation credit, not as a blueprint for control redesign. This is a category error. These 10 factors describe the characteristics of misconduct the government wants to find. If your monitoring can't identify those characteristics early, you've lost the window for self-disclosure and remediation credit.
Mistake 1: Treating the Memo as Guidance, Not a Control Specification
Why it happens: Compliance teams read enforcement memos like sentencing guidelines. You extract the cooperation requirements, note the penalties, and move on. You don't ask, "Can my current controls detect this before prosecutors do?"
The consequence: You discover a fraud scheme through a whistleblower complaint or external audit. By the time you investigate, the misconduct has already crossed multiple business units and lasted long enough to trigger the Fraud Division's interest. You had detective controls in place, but they weren't calibrated to catch multi-district schemes or management-concealed fraud.
The fix: Map each of the 10 Fraud Division factors to specific control activities in your program. For the factor addressing frauds that span multiple districts, ask: Can you analyze transactions across regional offices? Can you correlate hotline reports from different geographies that describe similar misconduct? If your fraud risk assessment treats each business unit as a silo, you can't answer yes. You need cross-functional data analysis capabilities and a monitoring protocol that flags patterns across organizational boundaries, not just within them.
Mistake 2: Running Fraud Risk Assessments Without Escalation Triggers
Why it happens: Your internal audit team conducts an annual fraud risk assessment. It identifies high-risk areas, rates inherent and residual risk, and produces a heat map. What it doesn't produce is a set of real-time escalation triggers tied to the specific fraud patterns the Fraud Division will prosecute.
The consequence: You have risk ratings but no early-warning system. A fraud that meets multiple Fraud Division factors, such as estimated losses exceeding $25 million or senior management involvement, sits in your case management system for weeks before anyone recognizes its severity. By the time you escalate, the window for voluntary disclosure has closed.
The fix: Build a fraud risk dashboard with quantitative escalation triggers. Include metrics like the number of fraud allegations involving management, potential loss estimates, number of jurisdictions implicated, and duration before detection. Set mandatory escalation thresholds. For example: "Any investigation indicating fraud losses above $10 million, or implicating more than two business units, must be escalated to the chief compliance officer within 24 hours for self-disclosure assessment." This isn't hypothetical monitoring. It's a structured protocol that forces human review when specific Fraud Division factors appear in your data.
Mistake 3: Assuming Internal Audit Will Handle Control Mapping
Why it happens: Internal audit already runs fraud risk assessments. You assume they'll map the Fraud Division factors to existing controls and tell you what needs to change. But internal audit's mandate is assurance, not compliance program redesign. They'll test whether your controls work as documented. They won't necessarily tell you that your documented controls are insufficient for the new enforcement landscape.
The consequence: You wait for internal audit's next report to identify gaps. Meanwhile, your detective controls continue to miss the fraud patterns prosecutors are targeting. You're relying on a function that audits your program, not one that builds it.
The fix: Take ownership of control mapping. Use a risk-control matrix that links each Fraud Division factor to preventive, detective, and monitoring controls you'll implement. For frauds lasting multiple years (one of the 10 factors), your detective controls might include trend analysis of transaction patterns and aging reports for unresolved audit findings. Document who performs each control activity, with what data, and how often. Then ask internal audit to validate your mapping and test your new controls. You're inverting the relationship: you design the controls, they provide assurance.
Mistake 4: No Defined Threshold for Multi-Jurisdictional Investigations
Why it happens: When you receive a hotline report or discover a control failure, you investigate the specific incident. You don't automatically ask, "Could this misconduct exist in other offices or business units?" That question requires additional resources and a broader investigation scope, which you're reluctant to authorize without clear evidence.
The consequence: You close an investigation after finding misconduct in one location. Six months later, a second complaint surfaces in a different region, describing identical behavior. Only then do you realize the scheme was widespread. The Fraud Division's focus on multi-district fraud means this pattern will attract prosecution. You had two chances to discover the full scope and failed both times.
The fix: Establish a mandatory scope expansion protocol. If any investigation uncovers fraud involving management, third-party relationships, or government contracts, you must assess whether similar misconduct could exist in other jurisdictions. This requires cross-functional data access. Can your compliance team query transaction data from multiple regional systems? Can you search email archives across business units for similar keywords or patterns? If not, work with IT and internal audit to build that capability now. Document the scope expansion decision in every investigation file, even when you conclude the misconduct was isolated.
Mistake 5: Treating Fraud Detection as a Compliance-Only Responsibility
Why it happens: Compliance owns the hotline, the code of conduct, and the investigation process. You assume fraud detection is your job. But the Fraud Division factors describe fraud patterns that manifest in financial data, procurement systems, billing exceptions, and contract performance, all of which sit outside your direct visibility.
The consequence: Finance discovers duplicate payments during a routine audit. Procurement identifies suspicious vendor relationships during a contract review. HR flags unusual expense patterns during a termination process. Each function reports these findings through their own channels. No one connects them to the fraud factors that would trigger Fraud Division interest, because no one outside compliance has read the enforcement memo.
The fix: Distribute the Fraud Division factors to Second Line and operational risk functions. Provide Finance, Procurement, HR, and IT with a one-page summary of the 10 factors and examples of how those factors might appear in their data. For instance, Finance should know that billing exceptions on government contracts or refund claims above certain thresholds require immediate escalation. Procurement should recognize that vendor relationships involving management or spanning multiple regions meet Fraud Division criteria. You're not asking them to become compliance experts. You're giving them a checklist of red flags that require your involvement.
Prevention Checklist
- Map each of the 10 Fraud Division factors to specific detective and preventive controls in your program
- Document who performs each control activity, with what data source, and at what frequency
- Build a fraud risk dashboard with quantitative escalation triggers (loss thresholds, number of jurisdictions, management involvement, duration)
- Establish a mandatory escalation policy for investigations that implicate one or more Fraud Division factors
- Create a scope expansion protocol requiring assessment of multi-jurisdictional fraud when certain patterns emerge
- Provide Second Line and operational functions with a summary of Fraud Division factors and examples relevant to their data
- Verify you can analyze transactions and correlate incidents across business units and geographies
- Set review intervals (quarterly or semi-annual) to assess whether your controls are detecting the fraud patterns prosecutors prioritize
- Engage internal audit to validate your control mapping and test new detective controls, not to design them for you
The Fraud Division's enforcement memo isn't optional reading. It's a technical specification for what your compliance program must be able to detect and escalate. If your controls can't surface these patterns before prosecutors do, you're not running a compliance program. You're running a documentation exercise.
