Deep Dive: the Legal Reasoning Behind DOJ’s New Corporate Criminal Liability Framework

Why the DOJ Abandoned the "One Bad Actor" Defense After 25 Years

In my 25 years as a federal prosecutor, I saw too many corporations escape accountability by pointing to a single rogue employee and claiming that the company's culture was otherwise pristine. The new framework, codified in Justice Manual Section 9-28.800, explicitly rejects this approach by requiring prosecutors to examine whether the company's compliance program was designed to prevent precisely the type of misconduct that occurred. This shift is grounded in the recognition that corporate criminal liability under respondeat superior, as established in New York Central & Hudson River Railroad Co. v. United States, 212 U.S. 481 (1909), holds companies vicariously liable for any employee's actions taken within the scope of employment, regardless of the employee's intent to benefit the company. The DOJ now demands that corporations demonstrate "the culture of compliance" rather than merely scapegoating a low-level employee who violated otherwise sound policies. Prosecutors are instructed to evaluate whether compensation structures, promotion criteria, and disciplinary systems actually reward ethical behavior or inadvertently encourage corner-cutting. This represents a fundamental shift from the "check-the-box" compliance era toward a substantive evaluation of corporate DNA.

The New Compensation and Recidivism Penalties Under the Justice Manual

The most consequential change in the framework appears in Section 9-28.730, which now mandates that prosecutors consider whether a corporation's compensation system includes "compliance-linked incentives" as a factor in determining the appropriate resolution. Specifically, the DOJ expects companies to implement clawback provisions that allow recovery of bonuses and equity grants from employees who engaged in misconduct or who failed to supervise subordinates who did. This provision draws directly from the authority granted under the Sarbanes-Oxley Act of 2002, Section 304, which permits the SEC to seek clawbacks from CEOs and CFOs, but the DOJ's new framework extends this expectation to all corporate employees with supervisory authority. Additionally, the framework introduces a recidivism penalty under Section 9-28.1100 that creates a rebuttable presumption that any company with a prior criminal conviction, deferred prosecution agreement, or non-prosecution agreement within the preceding ten years should face a guilty plea rather than a lenient resolution. This presumption can only be overcome by extraordinary cooperation, complete remediation, and evidence that the company's compliance program has been fundamentally restructured since the prior offense. In my experience, this provision will have the most significant impact on companies in regulated industries like healthcare, financial services, and government contracting, where repeat violations have historically been resolved with successive deferred prosecution agreements.

The Voluntary Self-Disclosure Presumption and Its Practical Limitations

The framework codifies a clear presumption in Section 9-28.900 that voluntary self-disclosure of misconduct, made before the government has independently uncovered the wrongdoing, creates a presumption against prosecution. However, this presumption is conditioned on the company providing "all relevant facts" and identifying "all individuals substantially involved in the misconduct, regardless of their position within the organization." This requirement creates a tension with attorney-client privilege and the Fifth Amendment rights of individual employees, as corporations must decide whether to waive privilege and compel employee cooperation to qualify for the presumption. The DOJ's guidance explicitly states that a company's failure to identify culpable executives will disqualify it from the presumption, even if the company otherwise cooperates fully. This places corporate counsel in an extraordinarily difficult position, as they must assess the strength of the government's potential case while advising the board on whether to risk individual prosecutions of senior leadership in exchange for corporate immunity. The framework also requires that the self-disclosure be "truly voluntary," meaning the company cannot have had prior notice of a government investigation through subpoenas, whistleblower complaints, or media reports. I have advised numerous clients that the window for voluntary disclosure is often far narrower than they assume, and that delaying disclosure while conducting an internal investigation can forfeit the presumption entirely.

How the Framework Changes the Role of Corporate Compliance Officers

Under the new framework, corporate compliance officers are no longer merely advisors but are effectively gatekeepers whose judgments carry prosecutorial weight under Section 9-28.600. The DOJ now expects compliance officers to have direct reporting lines to the board of directors, sufficient autonomy from legal and business leadership, and adequate resources to test the effectiveness of compliance controls through data analytics and random audits. Perhaps most significantly, the framework requires that compliance officers have "substantive input" into compensation decisions for employees in high-risk roles, including the authority to recommend forfeiture of bonuses or other incentives for compliance failures. This elevates the compliance function to a level of operational authority that many companies have been reluctant to grant, but the DOJ has made clear that a compliance officer without real power is a compliance officer whose program will be deemed ineffective. The framework also emphasizes the importance of "continuous improvement," requiring companies to regularly update their compliance programs based on lessons learned from internal investigations and industry-wide enforcement trends. In practice, this means that a company's compliance program will be judged not by its written policies but by its demonstrated ability to detect, prevent, and remediate misconduct in real time. Companies that treat compliance as a static document rather than a dynamic system will find themselves facing significantly harsher penalties under the new framework.

If your company is evaluating its compliance program in light of this new framework, or if you are facing a government investigation where these provisions may apply, I encourage you to contact our firm for a confidential consultation. With over two decades of experience as a federal prosecutor and now as a criminal defense attorney, I have guided dozens of corporations through the complexities of DOJ resolutions and compliance program restructuring. The window for proactive compliance reform is closing, and companies that wait until a subpoena arrives will find themselves at a significant disadvantage under the new recidivism and compensation provisions. Do not assume that your existing program meets the new standards—schedule a compliance audit with our team today to ensure your organization is prepared for the DOJ's heightened expectations.