1. Build a Remediation Record from Confirmed Control Failures
Once an investigation identifies a control weakness, the company needs evidence of what it changed, who approved the change, and whether it worked. The file should not duplicate interviews or treat every policy breach as unlawful.
Connect Each Finding to the Root Cause
A payment approved without required review may reflect shared system access, poorly defined approval limits, or a manager's override. Different causes require different corrections. Identify the failed control, earlier warnings, and unresolved facts.
The DOJ's Evaluation of Corporate Compliance Programs asks federal prosecutors to consider root-cause analysis, missed opportunities to detect misconduct, and the company's corrective measures. Its questions are federal evaluation criteria, not a mandatory checklist. Keep the underlying government and internal investigations materials separate from routine implementation records.
Assign Each Action an Owner and Evidence Requirement
A tracking register should identify the corrective action, accountable owner, target date, and proof of completion. A reviewer should check the underlying weakness against dated records, not a manager's assurance.
| Control Failure | Corrective Action | Evidence to Retain |
|---|---|---|
| Payment approval bypass | Restrict approval rights | Permission change log |
| Unclear policy exception | Revise escalation rule | Approved policy version |
| Repeated oversight gaps | Introduce exception review | Review log and test results |
Payment approval bypass
- Corrective ActionRestrict approval rights
- Evidence to RetainPermission change log
Unclear policy exception
- Corrective ActionRevise escalation rule
- Evidence to RetainApproved policy version
Repeated oversight gaps
- Corrective ActionIntroduce exception review
- Evidence to RetainReview log and test results
Leave unsupported findings open for further review.
2. Preserve Proof of Policy, Authority, and Personnel Changes
A revised corporate policy is only one part of a remediation record. The company should also retain evidence that the new rule reached the right employees and changed how decisions are made. Record improvements tied to the original weakness.
Retain Policy Versions and Operational Permissions
Keep the former policy, approved replacement, effective date, and record of distribution. For a payment-control failure, preserve updated delegation limits, system access settings, and the administrator's dated confirmation that permissions changed.
A policy may require dual approval while a single user can still release funds. A compliance program design describes intended safeguards; remediation evidence shows whether the company put those safeguards into operation. For exceptions, note the approver, reason, and expiry.
Document Training and Discipline on Different Records
Training attendance proves that an employee participated, not that the employee understood the procedure. Keep role-specific materials, completion dates, and practical assessments where appropriate. Supervisors may need different exercises from invoice preparers.
U.S.S.G. § 8B2.1(b)(4)-(7) addresses communication, monitoring, discipline, and responses to misconduct in federal organizational sentencing. It does not prescribe one training format for every company. Record disciplinary reasons separately from training results. California Labor Code § 1102.5 prohibits retaliation for qualifying reports or refusals to participate in unlawful activity. A company should review protected activity before disciplining someone who reported a compliance concern.
3. Verify That Revised Controls Work in Practice
Implementation and effectiveness are distinct. Policies and training show action; operating records show results. Tests should be proportionate to the misconduct risk and the information available.
Test Post-Change Transactions with a Clear Method
Choose transactions processed after the correction and record the review period, selection method, expected approval steps, and result for each item. Retain identifiers linking each test to its source. A compliance audit may provide independent review, but a useful test must still explain what the reviewer examined.
A June policy signature cannot prove that July payments followed revised rules. A sample of July transactions can reveal whether separate employees initiated and approved payments. Neither DOJ guidance nor § 8B2.1 sets a universal sample size or frequency for this kind of test.
Record Exceptions and Retest after Further Changes
A failed test should remain in the file. Note whether the failure came from an incorrect system setting, inadequate training, or deliberate circumvention. Assign a follow-up action and decide when enough new transactions will exist for meaningful retesting.
Do not erase failed results when later checks pass. The sequence shows how management responded. If exceptions recur, consider a different approval design or independent review rather than another general reminder to employees.
4. Close Remediation Items Only after an Evidence Review
A closure decision should distinguish work completed from work shown to be effective. A deadline does not prove a weakness disappeared. The reviewer should be able to trace the finding, correction, tests, and remaining risk through the file.
Separate Implementation Dates from Validation Decisions
Record when the company changed the control, when a reviewer tested it, and who approved closure. Note small samples or too few new transactions. An item may be implemented but remain open for validation.
If an agency order, settlement, or contract imposes specific reporting or retention duties, those requirements govern. DOJ evaluation guidance does not establish a universal remediation closure deadline. Residual risks should have a named owner and a scheduled review.
Keep Oversight and Privilege Records Distinct
A management or board summary should identify material weaknesses, overdue actions, failed tests, and decisions requiring resources. That gives ethics and compliance oversight a factual basis beyond completion percentages. Preserve evidence under applicable retention rules and any legal hold.
Routine business records do not become attorney-client privileged merely because an attorney receives them. Legal advice and privileged investigative analysis require separate evaluation before disclosure. A closed file documents a review, not a guarantee against future misconduct.
04 Nov, 2026
