A whistleblower report lands in your compliance inbox. You have 120 days to investigate, decide whether to self-disclose to the Department of Justice (DOJ), and document every step. This is the operational reality under the DOJ's 2026 Unified Corporate Enforcement Policy, announced in March 2026. The policy replaced district-by-district prosecution standards with a single national framework, treating real-time compliance operations as a core defense asset, not just a paperwork exercise.
This checklist guides you through the necessary steps from the moment an internal report arrives. Each item is designed to fit within the 120-day window and produce the defensible, timestamped record the DOJ expects when evaluating voluntary self-disclosure, cooperation, and remediation.
Prerequisites
Before executing this checklist, ensure your compliance program has these foundational elements:
A live system of record. You need a platform that generates immutable audit logs for policy versions, training completion, and exclusion screening. Spreadsheets are editable and lack reliable timestamps. Ensure any compliance officer can pull a complete training history for any employee within five minutes, with system-generated proof of when each module was completed.
Defined escalation thresholds. Your intake process must include written criteria for what constitutes a high-severity report, such as suspected fraud or falsified records. Implement a triage protocol that routes high-severity reports to legal counsel and the compliance committee within 24 hours of receipt.
Preserved communication channels. Investigators need access to ephemeral messaging apps, personal devices used for work, and system logs. Establish a written policy requiring employees to preserve all work-related communications on any platform, with IT protocols to image devices before data is wiped.
Checklist Items
1. Log the intake timestamp. Record the exact date and time the internal report was received. This is when the 120-day clock starts. Use a ticketing system that auto-generates a case number and timestamp the moment a report is submitted, with no manual data entry.
2. Classify the report type. Determine whether the allegation involves criminal misconduct or a civil overpayment. Criminal matters follow the DOJ's 120-day track. Overpayments trigger a separate 60-day civil self-disclosure clock under OIG or CMS protocols. A single incident can trigger both. Use a classification field in your intake form that flags dual-clock scenarios and alerts legal counsel automatically.
3. Preserve all evidence immediately. Issue a litigation hold to IT within 24 hours. This includes EHR records, claims data, billing system logs, email, and any ephemeral messaging platforms. Use a pre-drafted litigation hold template with named custodians, a defined scope, and IT confirmation that backups have been isolated from routine deletion cycles.
4. Assemble the investigation team. Identify who will conduct witness interviews, pull records, and analyze findings. Include legal counsel from the start. Have a standing investigation protocol that names roles and assigns clear responsibilities before the first report arrives.
5. Scope the investigation. Define what you're investigating and what you're not. Fraud cases tend to expand as you pull records. Set boundaries early and document any scope changes. Create a written investigation plan with defined objectives, data sources, interview targets, and a timeline, updated each time the scope shifts.
6. Conduct witness interviews. Interview every individual with direct knowledge, regardless of rank. The DOJ's cooperation standard requires identifying all involved parties. Maintain contemporaneous interview notes, signed witness statements, and a log showing who was interviewed, when, and by whom.
7. Analyze the root cause. Go beyond who did what. Identify the control failure that allowed the misconduct to occur. Conduct a written root-cause analysis that traces the issue to a specific policy gap, training deficiency, or system weakness, with proposed corrective actions tied to each finding.
8. Calculate your Mean Time to Resolution. Track how long each phase of the investigation takes. If you're consistently running past 90 days before reaching a disclosure decision, you have a process bottleneck. Use a dashboard that shows days elapsed by phase across all open cases, with outliers flagged for escalation.
9. Document remediation in real time. Don't wait until the investigation closes to implement corrective actions. Discipline, policy updates, and system fixes should happen as soon as findings are confirmed. Keep timestamped records showing when a policy was revised, when retraining was completed, and when access controls were tightened, all tied to the investigation case number.
10. Make the disclosure decision. Within the 120-day window, legal counsel and leadership must decide whether to self-disclose to the DOJ. Voluntary self-disclosure, before the misconduct becomes public or before an imminent government investigation, is one of three pillars for earning a declination of prosecution. Document the decision, the factors considered, and the rationale in a written memo, signed by the compliance officer and legal counsel.
Common Mistakes
Treating the 120-day window as a suggestion. The clock starts when the report arrives, not when you've finished your investigation. Missing the window forfeits voluntary self-disclosure credit.
Relying on static compliance binders. The DOJ's evaluation guidance instructs prosecutors to ignore programs that exist only on paper. If your compliance records aren't live and timestamped, they don't count.
Failing to preserve ephemeral communications. Deleted WhatsApp threads or wiped personal devices destroy evidence the DOJ expects you to produce. Preservation holds must cover all platforms, not just corporate email.
Conflating the criminal and civil clocks. A billing error that triggers a 60-day overpayment clock can also involve fraud that triggers the 120-day DOJ clock. Misrouting the disclosure, or letting the faster clock lapse, forfeits credit on both sides.
Next Steps
Audit your last 12 months of hotline intake data and calculate your actual Mean Time to Resolution. Anything over 60 days points to your first bottleneck. Locate where your policy attestations, training records, and exclusion-screening logs actually live. If they're scattered across folders or managed in spreadsheets, start mapping a transition to a consolidated, audit-ready system. Finally, bring a risk-mitigation report to your compliance committee that connects a tech-enabled compliance program directly to reduced individual liability for directors and officers under the new policy.
The DOJ announced a National Health Care Fraud Takedown in June 2026 that resulted in over $6.5 billion in false claims charges. That number came from real-time data analytics and cross-agency data sharing that flag billing anomalies as they happen. Your compliance program needs to operate at the same speed.
