Each question becomes evidence tests
Each of DOJ's three questions turns into a set of tests we can answer with evidence rather than opinion.
Design starts from real risks
We check that the program begins with a risk assessment, that policies address the risks it found, and that a buyer in procurement and a sales lead in a new market receive different training. A program designed for generic risks scores as partial, however complete it looks on paper.
Resources and authority are measurable
We look at who runs compliance, how much of their time it takes, whom they report to and whether they can reach the board without passing through management. We also check whether compliance can get at the data it needs, which the guidance asks about directly.
Practice is where documents end
We trace real reports from intake to closure, test whether third-party approvals followed the due diligence policy, and run data tests on payments, expenses and vendor records. A program that works leaves evidence: reports investigated and closed, lessons fed back into controls, discipline applied consistently at every level.
Proportionate means right-sized answers
Scaling the guidance means keeping every question and adjusting the answer. A 300-person company selling to domestic customers might need a part-time compliance lead, an annual risk assessment, a code and a hotline it actually tests, and a quarterly report to the audit committee. Add distributors in higher-risk markets and the answer grows to third-party due diligence and payment monitoring. The evaluation tells you which answer fits your risk, and our fraud risk assessment can fill the risk-assessment gap if there is one.
Self-disclosure starts with detection
DOJ's department-wide Corporate Enforcement Policy rewards companies that find problems and report them first. Under the Corporate Whistleblower Awards Pilot exception, a company must self-disclose as soon as reasonably practicable, and no later than 120 days after an internal report, to stay eligible. Both depend on a program that detects and escalates quickly. The evaluation checks the path from a report to a decision: who learns of a serious allegation, how quickly counsel is involved, and who has authority to decide on disclosure. If that path runs through the person most likely to be implicated, it is the first fix. For how the incentives work, see the 2026 enforcement policy explainer.