Most compliance officers instinctively want to finish an investigation before considering voluntary self-disclosure. Get the facts right, scope it properly, brief the board, and then decide. It sounds prudent, and often it is.
However, a recent Justice Department resolution reveals a blind spot in this approach that could mean the difference between a declination and a non-prosecution agreement.
Rethinking Conventional Wisdom
Typically, the process is sequential: a report comes in, you start an investigation with outside counsel, establish facts, present findings to leadership, and then decide whether to disclose to regulators. The fear is that early disclosure risks inaccuracies or overwhelms agencies with non-issues.
These concerns are valid. Premature disclosure can embarrass the company and waste time. No one wants every hotline tip to trigger a call to Main Justice.
Why This View Falls Short
This approach treats investigation and disclosure as a single process. They're not. They run on different timelines, and only one is under your control.
You control the investigation timeline: scope, staffing, interviews, forensic work. The disclosure timeline is controlled by external factors, like reporters, regulators, or whistleblowers. Under the Justice Department's Corporate Enforcement Policy, a disclosure made under "imminent threat" from another party doesn't count as voluntary.
Consider Extreme Networks. The company paid $2.5 million to resolve sanctions charges related to its Russian subsidiary, with $975,000 to the Justice Department and $1.53 million to the Office of Foreign Assets Control. It also entered a three-year non-prosecution agreement. Despite doing most things right, including a good-faith investigation and board briefing, timing was an issue. After the summer board presentation, the matter sat until October 2022, when a news outlet revealed unknown facts. Extreme reopened the investigation and disclosed just before publication. Prosecutors called it a "near miss" Voluntary Self-Disclosure. Good-faith diligence didn't earn credit because the disclosure came under imminent threat.
Key Lessons
Three aspects of this case should reshape your process.
The gap between findings and decision is a liability. Once misconduct is known, the disclosure decision is live. Each week of indecision is a week where an outside party might overtake you. The risk isn't the investigation itself; it's the pause afterward.
Internal reporting isn't always enough. The whistleblower channel worked, surfacing a problem from 2018 to 2022 at a subsidiary acquired through bankruptcy. That's a control success. But a working intake mechanism only starts your clocks. It doesn't manage them.
Overseas subsidiaries complicate timelines. Employees in Moscow allegedly concealed the true end-use buyer, and a centralized U.S. compliance team didn't question the distributor-buyer relationship for years. Thin visibility into foreign entities means new facts can come from outside your information flow, as happened when the reporter provided details unknown to the company's counsel.
Strategic Steps Forward
Don't disclose everything immediately. Instead, build a decision structure independent of investigation completion.
Set a disclosure decision trigger. Define in your Incident Response Structure when credible evidence of a potential violation requires a disclosure decision, even if facts are incomplete. Tie it to a Severity Level, not the close-out memo.
Document all decisions. If management decides disclosure isn't needed, record the reasoning, facts relied on, and a reassessment date. This record protects you if regulators later disagree.
Assign responsibility and reassessment after board briefings. A board presentation isn't a decision. Leave every briefing with a clear next action, an owner, and a date. Silence after a presentation can lead to dormancy.
Monitor external-party exposure. Ensure your legal and communications teams have a path for press inquiries, regulator contacts, and counterparty questions to reach the investigation lead the same day. Treat inquiries as new facts that trigger immediate reassessment of the disclosure decision.
Pressure-test subsidiary visibility. For foreign entities, verify that end-use and customer due diligence is performed or independently reviewed outside the local office. Use Entity-Level Controls like screening and escalation rules, with Automated Control Testing or periodic Audit Fieldwork, not just local self-reporting.
When Conventional Wisdom Holds
Thoroughness is still important. Disclosing with materially wrong facts can damage credibility and cooperation credit. There's a risk that prioritizing speed leads to disclosing every inquiry, which isn't beneficial for the company or enforcement agencies.
If you've conducted a sound investigation, concluded in good faith that no disclosure is needed, and documented why, that judgment deserves respect. Punishing honest conclusions encourages silence, which regulators don't want.
The point isn't to disclose sooner by default. It's to decide sooner, deliberately, and on the record. The investigation will take as long as it takes. Your disclosure window might not wait for it.
