For years, many companies have approached fraud investigations as an event-driven exercise: An allegation surfaces, an internal review begins and management determines what to do next. The U.S. Department of Justice’s (DOJ’s) latest corporate enforcement directive and follow-up directive, released in early October, reinforce why that approach may no longer be sufficient.
The directives raise an immediate question for general counsel, compliance leaders and audit committees: Can your existing controls identify emerging patterns before they escalate?
On October 1, 2026, the National Fraud Enforcement Division issued Directive 26-12, identifying four corporate investigation priorities and 10 non-exhaustive factors Fraud Division prosecutors must give “great weight” when recommending charges and negotiating resolutions. Several are notably specific, including conduct furthering a scheme for at least three years, conduct affecting three or more federal districts, and conduct causing financial harm to at least 25 victims or losses of $25 million or more.
At the same time, DOJ’s National Fraud Detection Center is using data-driven investigative techniques to generate leads. Directive 26-12 also instructs Fraud Division leadership to design and implement policies and programs that appropriately incentivize whistleblowers, including individuals who participated in misconduct. DOJ has not yet publicly identified a separate, implemented Fraud Division incentive program.
A follow-on memorandum issued October 7, Directive 26-13, adds further context. It directs prosecutors to use a comprehensive mix of criminal, civil, asset-recovery and disruption tools against fraud schemes. Together, the directives point toward earlier detection, coordinated enforcement, and a broader view of the actors and infrastructure that enable the misconduct.
>> Our Take: A subpoena may no longer be a company’s first warning. Government investigators may identify suspicious cross-program or cross-jurisdictional patterns before those patterns are recognized, connected or adequately investigated internally.
For boards, general counsel and compliance leaders, the question is no longer simply whether the company has a fraud risk assessment and reporting hotline. It is whether those mechanisms can identify, escalate and resolve the specific risks DOJ has placed in focus.
Directive 26-12 identifies the following priority areas:
These priorities do not define the full universe of potential corporate enforcement risk, but they indicate where Fraud Division resources and attention are likely to be concentrated.
The Directive also requires Fraud Division prosecutors to work closely with the Corporate Enforcement Section throughout corporate investigations. Prosecutors must report ongoing corporate investigations to the Section within seven days of the Directive’s issuance, promptly notify the Section of new matters and major developments, and involve it, as appropriate, from intake through resolution or litigation.
Perhaps most consequential are the 10 non-exhaustive factors that prosecutors must give great weight when recommending charges and negotiating resolutions:
>> Our Take: These factors are not automatic charging triggers, and falling below a numeric threshold is not a safe harbor. They are a roadmap to the considerations DOJ has said should receive great weight in Fraud Division corporate matters. From a forensic and compliance perspective, that roadmap should inform how companies assess risk, analyze transactions and investigate potential misconduct.
Most companies periodically assess fraud risks by business unit, transaction type or regulatory exposure. Those assessments remain valuable, but they may not reveal how potential misconduct intersects with DOJ’s charging and resolution considerations.
Start by mapping each factor to relevant operations, controls and available data. Can the company identify transactions involving taxpayer-funded programs? Can it connect payments, vendors and contracts across business units? Can it detect management approval, repeated overrides, or efforts to conceal activity from auditors or government agencies?
For healthcare organizations, that may mean analyzing billing patterns, adjustments and relationships with referral sources. Government contractors may focus on procurement transactions, subcontractor payments and certifications. Importers may examine customs classifications, declared values, sourcing records and supplier relationships.
>> Our Take: The objective is not another lengthy risk-assessment document. It is a prioritized set of testable questions, supported by data, with clear ownership for investigating exceptions. The critical shift is to move from identifying where fraud might occur to testing for existing indicators and continuously monitoring for emerging patterns.
Directive 26-12’s instruction to develop incentives for whistleblowers who participated in misconduct deserves particular attention. The direction is prospective, but the compliance implication is immediate. An employee involved in questionable conduct may possess detailed knowledge of transactions, approvals, communications and efforts to conceal wrongdoing. If that individual lacks confidence in the company’s reporting process, the organization may lose an important opportunity to identify and address the issue internally.
Companies should test whether the hotline functions as intended and monitor its effectiveness over time. Are reports promptly triaged? Are allegations involving senior management escalated independently? Can employees raise concerns without fear of retaliation? Are recurring allegations across locations or business units being connected?
>> Our Take: Monitor hotline data and case management data for repeated themes, delayed investigations, unexplained closures and allegations that never reached the appropriate decision-makers. Just as importantly, examine whether the company’s response to prior complaints supports a credible speak-up culture. A reporting mechanism that employees do not trust is not an effective early warning system.
When a significant allegation emerges, valuable time can be lost deciding who will lead the investigation, where relevant data resides and how electronic evidence should be preserved. That uncertainty is avoidable.
Working with legal counsel, companies should establish an investigation-readiness protocol addressing escalation authority, independence, evidence preservation, access to financial systems, employee communications and external specialist support. The protocol should identify circumstances requiring board or audit committee oversight, particularly when allegations involve senior management or potential concealment.
From a forensic perspective, readiness also means knowing whether the organization can quickly obtain and analyze relevant general-ledger transactions, payments, procurement records, communications and other electronic evidence. Counsel should determine the appropriate structure for sensitive investigations, including whether and how attorney-client privilege or work-product protections may apply.
>> Our Take: The goal is not to investigate every allegation as though it were a major enforcement matter. It is to ensure the organization can respond proportionately, independently and effectively when the facts warrant it.
Directive 26-12 requires Fraud Division prosecutors to follow DOJ’s department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy. It also highlights a practical challenge: companies may have less time than they assume to determine what happened before authorities independently identify the conduct.
That does not mean companies should disclose every allegation. Disclosure decisions require careful legal analysis of the facts, applicable policies, potential benefits and risks. But companies should be prepared to develop a reliable factual picture quickly.
A disciplined forensic response can help establish the nature of the conduct, the individuals involved, relevant time periods, estimated financial impact, affected jurisdictions and whether questionable activity remains ongoing. This information allows counsel and company leadership to evaluate disclosure options on an informed basis rather than relying on preliminary assumptions.
>> Our Take: The strongest position is neither to rush toward disclosure nor to delay while waiting for perfect information. It is to have a credible process for developing the facts, escalating significant findings and making timely decisions with counsel.
Two of DOJ’s factors are especially useful in designing ongoing internal monitoring: conduct furthering a scheme for three years or more, and conduct affecting three or more federal districts.
Traditional fraud reviews often concentrate on transaction amounts or isolated exceptions. That can miss smaller, recurring activity that becomes more significant over time or across locations. Companies should be able to connect similar anomalies across periods, subsidiaries, facilities, programs and geographic regions.
Consider a recurring vendor-payment irregularity. A single exception may appear immaterial. Similar exceptions occurring over several years, across multiple locations and involving common approvers may tell a very different story.
>> Our Take: Data analytics can support ongoing monitoring by identifying those relationships through recurring transaction patterns, common vendor identifiers, unusual approvals and repeated control overrides. Companies should not wait until a numerical threshold is reached. The factors provide escalation context, not permission to disregard earlier warning signs.
The larger lesson from Directive 26-12 is not that companies need more policies. They need better visibility into whether their controls work and whether available information is being monitored effectively for signs of emerging misconduct.
A focused, forensic-accounting-led compliance review can translate DOJ’s priorities into practical procedures: risk-to-control mapping, targeted transaction testing, ongoing monitoring of key fraud indicators, hotline-effectiveness reviews, investigation-readiness assessments, and analysis of recurring activity across business units and jurisdictions. These reviews need not become sprawling projects. When properly scoped, they can focus on the highest-risk processes and produce actionable findings for management, counsel and audit committees.
DOJ has made its priorities more explicit. Your company now has an opportunity to make its own detection and response capabilities equally deliberate. Work with a team of skilled forensic services professionals and legal counsel to investigate complex issues, assess fraud and compliance risks, and strengthen the processes used to identify and respond to misconduct.
Contact Rory Wilson or a member of your service team to discuss this topic further.
In this blog Cohen & Co is not rendering legal, accounting, investment, tax or other professional advice. Rather, the information contained in this blog is for general informational purposes only. Any decisions or actions based on the general information contained in this blog should be made or taken only after a detailed review of the specific facts, circumstances and current law with your professional advisers.