The Challenge
The Justice Department's new fraud division presents a strategic challenge for compliance officers: how do you prepare for enforcement priorities that aren't yet clear?
Unlike regulatory changes with defined processes and timelines, this DOJ shift signals increased scrutiny without clear boundaries. "Fraud" covers everything from securities violations to healthcare billing schemes. Your compliance program must address potential exposure across this spectrum, but you can't just add new controls without knowing where enforcement will focus.
This uncertainty creates a resource allocation dilemma. Overprepare, and you'll waste budget on unnecessary controls. Underprepare, and you risk becoming an early enforcement target.
The Environment and Constraints
Most compliance programs face three constraints that complicate this challenge:
Limited visibility into prosecutorial priorities. Unlike SEC or OFAC priorities, DOJ enforcement strategy becomes clear only through filed cases. By then, you're already behind.
Resource scarcity. Your compliance budget was set before this division existed. Adding fraud-specific controls means deprioritizing other areas or seeking additional funding.
Existing control frameworks. You've mapped controls to SOX, industry regulations, and perhaps COSO or ISO 31000. Adding another enforcement lens requires revisiting your entire control architecture.
For example, if you're in healthcare, you already maintain controls for FDA compliance, HIPAA, False Claims Act exposure, and financial reporting. Now, assess whether these controls address the fraud theories DOJ might pursue and if your testing frequency matches the enforcement risk.
The Approach
Don't wait for enforcement actions to clarify priorities. Take these immediate steps:
Map your fraud exposure by transaction type. Inventory every process where your organization makes representations to external parties: revenue recognition, government contracts, grant applications, insurance claims, regulatory filings, marketing materials, and vendor certifications. Document the controls that prevent material misstatements. This isn't about creating new controls yet; it's about understanding your current coverage.
Focus on areas where automation has replaced human review. If your billing system generates claims automatically, what controls prevent incorrect coding? If your procurement team uses templates for government contract certifications, who reviews them for accuracy before submission?
Assess control design against prosecutorial fraud theories. DOJ fraud cases typically rest on knowingly false statements, deliberate omission of material facts, or schemes to defraud. Review your control documentation with these theories in mind. Does your revenue recognition control prevent false statements, or just verify mathematical accuracy? Does your vendor due diligence process detect omitted conflicts of interest, or just confirm disclosure forms were submitted?
This review often reveals that controls designed for regulatory compliance don't address intent-based fraud theories. A control that verifies "proper documentation exists" won't catch situations where the documentation itself is misleading.
Strengthen your whistleblower and investigation protocols. DOJ's fraud cases often start with internal whistleblowers or self-disclosures. Your hotline effectiveness and investigation quality directly affect enforcement risk. Review your intake process: can employees report concerns anonymously? Do intake forms capture enough detail to assess fraud risk? Does your investigation protocol include fraud-specific elements like document preservation, interview sequencing, and privilege considerations?
Update your investigation escalation criteria to flag potential fraud scenarios early. If an employee reports that a supervisor instructed them to backdate documents or alter records, that should trigger immediate legal review, not just a standard HR investigation.
Results and Measurable Outcomes
Organizations that mapped fraud exposure before facing enforcement scrutiny report three consistent benefits:
They identified control gaps not visible in existing frameworks. A common finding: adequate controls over transaction execution but weak controls over representations made in external communications.
They reduced investigation costs when issues arose. Pre-mapped fraud exposure points meant investigators knew exactly which documents to preserve and which control failures to examine.
They improved board and audit committee reporting. Instead of generic "fraud risk" discussions, compliance teams could present specific exposure scenarios tied to business processes, making it easier to justify control investments.
Teams that struggled treated this as a documentation exercise rather than a substantive control review. Creating fraud risk assessments that simply restated existing control descriptions provided no new insight and didn't reduce enforcement exposure.
What They Would Do Differently
Compliance officers who've navigated similar shifts identify two mistakes to avoid:
Don't wait for enforcement guidance. Some teams delayed action, hoping DOJ would publish guidance on the new division's priorities. By the time enforcement patterns became clear, they'd lost six months of preparation. The better approach: make reasonable assumptions about high-risk areas based on historical DOJ fraud cases, then adjust as actual priorities emerge.
Don't treat this as a one-time project. The initial fraud exposure mapping is valuable, but enforcement priorities shift. Build ongoing monitoring into your compliance program: quarterly review of new DOJ fraud cases in your industry, annual reassessment of fraud exposure points as your business changes, and regular testing of whistleblower channels.
Takeaways for Your Team
Start with your highest-value transactions and work backward. Where does your organization make material representations to government agencies, customers, or investors? What controls prevent those representations from being false or misleading? If you can't answer those questions specifically, you've found your starting point.
Update your compliance risk assessment to explicitly address fraud theories, not just regulatory violations. Ask: if DOJ investigated this process, what would they look for? What documents would they subpoena? What witness testimony would they seek? Ensure your controls and documentation would withstand that scrutiny.
Finally, brief your board or audit committee now, before an enforcement action forces the conversation. Present your fraud exposure mapping, identify any control gaps, and outline your remediation timeline. That proactive disclosure demonstrates the kind of compliance culture that influences prosecutorial charging decisions.
The new DOJ fraud division won't publish a checklist of required controls. Your job is to build one anyway.
