1. Which Federal Requirements Call for a Compliance Review?
A business may face a regulatory examination, a required independent audit, or a voluntary internal review. These are different events with different legal consequences. Before reviewing records, identify the federal rule, regulated activity, and agency involved.
Determine Which Rules Apply
| Business Activity | Potential Federal Requirement |
|---|---|
| Public-company financial reporting | SEC filings and applicable internal-control assessments; auditor attestation depends on filer status. |
| Claims submitted to federal programs | Applicable claim rules; knowingly false claims may trigger False Claims Act liability. |
| International payments or trade | Applicable anti-bribery, sanctions, or export-control restrictions. |
Public-company financial reporting
- Potential Federal RequirementSEC filings and applicable internal-control assessments; auditor attestation depends on filer status.
Claims submitted to federal programs
- Potential Federal RequirementApplicable claim rules; knowingly false claims may trigger False Claims Act liability.
International payments or trade
- Potential Federal RequirementApplicable anti-bribery, sanctions, or export-control restrictions.
Distinguish Binding Rules from DOJ Guidance
The DOJ's Evaluation of Corporate Compliance Programs helps prosecutors assess corporate programs; it imposes no universal audit requirement. Identify binding rules separately; related regulatory compliance questions may call for a sector-specific review.
2. When Can a Compliance Failure Create Legal Liability?
An adverse audit finding is not proof of a violation. The governing statute determines the elements, required mental state, and remedies. Corporate and executive liability must be assessed separately, even for the same transaction.
Corporate Exposure Depends on the Violation
- Civil enforcement: A proven violation may require penalties, repayment, or other remedies.
- Criminal exposure: Acts within an agent's employment scope, intended partly to benefit the company, may create exposure.
- Program assessment: Prosecutors may evaluate whether compliance measures worked in practice.
Assess Executive Conduct Separately
Holding an executive title does not automatically create personal liability. Investigators may examine personal conduct, certifications, and duties imposed by a specific statute. Board oversight may raise separate state-law questions; review corporate governance obligations under the relevant entity law.
3. What Records Matter in a Federal Compliance Audit?
Corporate compliance audit requirements depend on the governing rule and the audit's purpose. Records must answer concrete legal questions, not merely demonstrate that a policy exists. An incomplete file also requires investigation before anyone treats it as evidence of misconduct.
Match Evidence to the Legal Question
| Question | Records to Examine |
|---|---|
| Was a required filing accurate and timely? | Submitted forms, confirmations, and underlying data. |
| Who approved a disputed transaction? | Contracts, approval logs, and payment records. |
| How did the business respond to a warning? | Incident reports, escalation emails, and corrective-action records. |
Was a required filing accurate and timely?
- Records to ExamineSubmitted forms, confirmations, and underlying data.
Who approved a disputed transaction?
- Records to ExamineContracts, approval logs, and payment records.
How did the business respond to a warning?
- Records to ExamineIncident reports, escalation emails, and corrective-action records.
Check Gaps before Drawing Conclusions
Compare missing documents with the applicable recordkeeping rule and normal business practices. Preserve original files and relevant metadata. A gap may reflect a recordkeeping failure without proving the underlying transaction unlawful, although the failure may raise a separate compliance issue.
4. Responding When an Audit Identifies Possible Misconduct
The first task is to determine what happened and which obligations follow. Disclosure, refund, and cooperation rules differ among federal programs. A premature public explanation may conflict with facts that have not yet been established.
Preserve Evidence and Identify Deadlines
- Preserve relevant electronic records, financial data, and audit work papers.
- Check any applicable notice, repayment, or reporting deadline.
- Consider an appropriately scoped investigation and potential privilege issues.
Evaluate Agency Contact and Disclosure
DOJ's 2026 corporate enforcement policy addresses qualifying voluntary disclosures in criminal matters; other agencies have separate rules. No disclosure guarantees immunity. Securities-related requests may involve SEC investigations.
5. Where Can Attorneys Assist with Federal Compliance Matters?
Legal support is most useful when the applicable rule, disputed facts, or agency demands are unclear. Attorneys can separate business improvements from legal obligations and assess what investigators may reasonably request. The scope of work depends on the issue and available records.
Review Obligations and Potential Exposure
- Identify governing federal rules and any relevant exceptions.
- Examine transaction records, certifications, and reporting obligations.
- Assess company exposure and potential individual liability separately.
Address Investigations and Corrective Measures
Attorneys can assess document requests, interview preparation, privilege, and possible disclosures. They can also review proposed remediation without representing that it will prevent enforcement. Significant allegations may warrant internal investigation services before decisions are finalized.
6. Frequently Asked Questions
Does every private business need an annual federal compliance audit?
No. An audit may be required by a particular federal rule or program, but there is no universal annual federal compliance audit mandate for private businesses.
Can a business keep using routine document deletion after an investigation is anticipated?
A duty to preserve relevant records can arise when litigation is reasonably anticipated. An investigation may also trigger specific retention duties. Assess routine deletion against those obligations.
Are internal audit reports automatically protected by attorney-client privilege?
No. Privilege generally protects confidential communications for legal advice, not ordinary business records merely shared with an attorney.
Can an outside auditor's findings be challenged?
Findings may be examined for factual errors, scope limitations, and unsupported assumptions. Whether a formal challenge is available depends on the audit's legal basis and applicable procedures.
7. Discuss Federal Audit and Liability Questions with SJKP
When an audit identifies a questionable transaction or an agency requests records, the company's next decision should rest on the applicable rule and the facts. SJKP's attorneys can assess federal obligations, potential liability, and available response options. Contact SJKP to discuss the relevant documents and the legal questions they raise.
30 Dec, 2025
