Checklist · Criminal

Responding to a Government Subpoena or Investigation: A Practical Checklist

31 U.S.C. § 3733

Type
Checklist
Jurisdiction
National
Date
2024-11-19
Topic
Criminal

When the government arrives — with a grand jury subpoena, a civil investigative demand, an administrative subpoena, or agents holding a search warrant — the first forty-eight hours shape everything that follows. This checklist walks the response phase by phase, beginning with the threshold question almost everyone gets wrong: what did you actually receive, and what does it legally compel? It then covers the immediate litigation hold and why destroying a single document can become a standalone felony under 18 U.S.C. § 1519; engaging counsel and establishing corporate privilege under Upjohn Co. v. United States, 449 U.S. 383 (1981); managing agents at the door and employee contacts; notifying D&O carriers; negotiating production scope; and running an internal investigation with proper Upjohn warnings. The later phases work through the hardest calls — cooperation under Justice Manual 9-28.000, voluntary self-disclosure, separate counsel and fee advancement, joint defense agreements, and the Fifth Amendment asymmetry in parallel proceedings. Each phase closes with the traps that turn a survivable investigation into an indictment, illustrated through a running clinical-laboratory hypothetical. Corporate governance points use Delaware as the reference jurisdiction and insurance points are state-specific — confirm your own state's rule, and get experienced white-collar counsel involved on day one.

Responding to a Government Subpoena or Investigation: A Practical Checklist

Criminal > White-Collar Crime | Published 19 November 2024 - Updated 22 February 2026 | UpLaw - uplaw.us

Almost no company is destroyed by the conduct the government first came to ask about. Companies are destroyed by what they do in the ninety days after the government asks. The cover-up, the deleted folder, the coached witness, the "helpful" employee memo — those are the crimes that get charged, and they are all committed after the subpoena arrives.

Keywords: government subpoena, grand jury subpoena, civil investigative demand, search warrant, litigation hold, obstruction, spoliation, Upjohn warning, internal investigation, cooperation credit, self-disclosure, joint defense agreement, advancement, parallel proceedings, Fifth Amendment

The scenario we will run

Vantage Meridian Diagnostics, Inc. is a 400-employee clinical laboratory company headquartered in Ohio with labs in four states. At 7:52 a.m. on a Tuesday, general counsel Dana Okoye takes a call from the front-desk receptionist: eleven people in windbreakers marked "HHS-OIG" and "FBI" are in the lobby. One of them is holding a piece of paper. Two more are already walking toward the billing floor.

Dana has about ninety seconds to decide what to do. What she does in those ninety seconds — and in the ninety days that follow — is the subject of this checklist.

Hour 0 — Identify what you actually received

Everything downstream depends on this. The four instruments below look superficially similar and are legally nothing alike.

  • [ ] Get the physical document into your hands and read it. Do not act on a description relayed by a receptionist.
  • [ ] Identify the issuing body: U.S. Attorney's Office / DOJ component? A federal agency (SEC, FTC, HHS-OIG, EPA, DOL)? A state AG? A congressional committee?
  • [ ] Classify the instrument:
    • Grand jury subpoena (Fed. R. Crim. P. 17) — issued in the name of the court at a prosecutor's request; compels documents (subpoena duces tecum) or testimony (ad testificandum). It signals a criminal investigation. It is a demand for production, not a license to search.
    • Civil investigative demand (CID) — a pre-suit compulsory process under a specific statute: the False Claims Act (31 U.S.C. § 3733), the Antitrust Civil Process Act (15 U.S.C. § 1312), or the FTC Act (15 U.S.C. § 57b-1). CIDs can compel documents, interrogatory answers, and oral testimony. An FCA CID very often means a sealed qui tam relator is sitting behind it.
    • Administrative subpoena or summons — issued by an agency under its own organic statute (e.g., SEC subpoenas under Exchange Act § 21(b), 15 U.S.C. § 78u(b); IRS summonses under 26 U.S.C. § 7602). The agency cannot enforce it itself; it must sue in district court, and the court applies the United States v. Powell, 379 U.S. 48 (1964) factors — legitimate purpose, relevance, information not already possessed, and administrative steps followed.
    • Search warrant (Fed. R. Crim. P. 41) — a judicial officer has already found probable cause. This is not a request. Agents will take things today.
  • [ ] Note every deadline on the face of the document and calendar it twice.
  • [ ] Preserve the envelope, the cover letter, and the name and card of every agent or AUSA.
  • [ ] Do not call the case agent yourself. Counsel calls; the client does not.

Why it matters, and the traps

A grand jury subpoena and a CID feel the same to a stressed executive and are wildly different in consequence. A CID may end in a civil settlement and a corporate integrity agreement. A grand jury subpoena means someone at DOJ believes a federal crime may have occurred, and everything you produce goes to a body that can indict.

The trap: treating a search warrant as negotiable, or a subpoena as a search. When Dana sees the words "SEARCH AND SEIZURE WARRANT," her job is not to argue scope in the lobby — it is to observe, document, and protect privilege. Conversely, if the paper is a subpoena, agents have no right to walk past the lobby, and letting them roam the billing floor because nobody said no is a self-inflicted wound.

Second trap: assuming a grand jury subpoena obligates you to secrecy. In the federal system, Rule 6(e) grand jury secrecy binds the government, not the witness. A cover letter "requesting" that you not disclose the subpoena is a request, not an order — and quietly complying with it can collide with your own disclosure duties. Read it carefully with counsel.

Hour 0 — If it is a SEARCH WARRANT: what to do while agents are in the building

  • [ ] Call outside white-collar counsel immediately and put them on speakerphone with the lead agent if possible.
  • [ ] Ask for and photograph/copy the warrant and the attachments (Attachment A: place to be searched; Attachment B: items to be seized). Read Attachment B — it defines the outer limit of what they may take.
  • [ ] Ask whether a filter/taint team is present to segregate privileged material, and say on the record, in front of a witness, that the company asserts attorney-client privilege and work product protection over legal files, GC's office, and counsel communications. Identify those locations.
  • [ ] Do not consent to anything beyond the warrant. Consent expands the search. Say clearly: "We do not consent; we will not obstruct."
  • [ ] Do not obstruct, block, hide, shred, delete, or lock anything. Do not "step out to make a call" and then start deleting.
  • [ ] Send employees home or to a conference room — politely, with pay. They are not required to answer questions. See the next phase.
  • [ ] Assign a "shadow" to each agent team (not to interfere — to take notes: what room, what was taken, what was said, what was photographed).
  • [ ] Log every item seized; demand the inventory receipt (Rule 41(f)(1)(B) requires one).
  • [ ] Ask for forensic images rather than hardware removal where the business will otherwise stop. Sometimes agents agree; often they do not. Ask anyway, and note the answer.
  • [ ] Do not discuss the merits with agents. "Our counsel will contact the AUSA today" is a complete sentence.
  • [ ] After they leave: reconstruct. Write a memorandum of everything taken and everything said, that day, at counsel's direction.

Why it matters, and the traps

Warrants are executed at 7 a.m. precisely because the government wants employees confused, alone, and talking. Every statement an employee makes to an agent is a potential 18 U.S.C. § 1001 false-statement charge if it is wrong — even if the underlying conduct was innocent. Employees do not appreciate that lying to an FBI agent in the parking lot is itself a five-year felony.

The trap Dana nearly falls into: a Vantage Meridian billing supervisor, trying to be helpful, tells an agent "we always got a physician order before billing" — which is true of 95% of claims and false as to a batch of 2,000. That single sentence can become a § 1001 count, and the company's later production proves it false. Counsel's instruction to employees must be neutral and lawful: you have the right to speak with agents, the right to decline, and the right to have a lawyer present; the company will not retaliate either way. Never tell employees they may not talk to the government. That instruction is itself potential obstruction and, for public companies, an independent violation of SEC Rule 21F-17's prohibition on impeding whistleblowers.

Hour 0 — Issue the litigation hold immediately; destroying anything is a separate felony

  • [ ] Issue a written litigation hold today — not after you understand the case. Understanding comes later; preservation comes now.
  • [ ] Suspend auto-delete: email retention rules, Slack/Teams message expiration, ephemeral messaging apps, voicemail purges, CCTV overwrite cycles, backup rotation, and the recycling of laptops from departing employees.
  • [ ] Identify custodians broadly (over-include; you can narrow later) and hit personal devices, personal email, and BYOD where work was done there.
  • [ ] Preserve structured data: the billing system, the LIMS, the EHR interface, the audit logs — data that no email search will ever capture.
  • [ ] Collect written acknowledgments from every custodian.
  • [ ] Instruct explicitly: do not delete, do not "clean up," do not create new summary documents about the conduct, do not discuss the investigation on chat.
  • [ ] Re-issue and re-acknowledge the hold every 60–90 days, and expand it as scope grows.

Work through UpLaw's Issuing a Litigation Hold and Preserving ESI: A Practical Checklist mechanically — the ESI mechanics are identical in a criminal matter, but the stakes are not.

Why it matters, and the traps

In civil litigation, spoliation gets you a Rule 37(e) sanction — see Moving to Compel Discovery and Seeking Rule 37 Sanctions: A Practical Checklist. In a federal investigation, spoliation gets you indicted:

  • 18 U.S.C. § 1519 (Sarbanes-Oxley § 802) — knowingly altering, destroying, or concealing any record "with the intent to impede, obstruct, or influence" the investigation of any matter within federal jurisdiction. Twenty years. It requires no pending proceeding and no subpoena — only intent to impede a federal matter that the defendant contemplates.
  • 18 U.S.C. § 1512(c) — corruptly destroying a record with intent to impair its availability in an official proceeding, or otherwise obstructing an official proceeding. Twenty years.
  • 18 U.S.C. § 1505 — obstruction of a pending agency or congressional proceeding.

Arthur Andersen LLP v. United States, 544 U.S. 696 (2005), reversed the firm's § 1512(b) conviction, holding that "knowingly ... corruptly persuades" requires consciousness of wrongdoing and that the jury instruction had swept in innocent conduct. But Andersen is a cautionary tale, not a shield. The firm was destroyed by the indictment, not saved by the reversal: by the time the Supreme Court ruled unanimously in its favor, the accounting practice no longer existed. Note the sequence carefully — Congress had already enacted § 1519 as part of Sarbanes-Oxley in 2002, in direct response to the document destruction at issue, precisely to reach record destruction without the elements the government struggled to prove in Andersen. A defendant who repeated Andersen's conduct today would face § 1519, not just § 1512(b), and the Andersen holding would not help.

The trap: the well-meaning IT director who "archives" a mailbox to free storage the week the subpoena lands, or the sales manager who tells his team to "clean up the group chat." Neither thinks of himself as a criminal. Both have just handed the prosecutor the easiest count in the indictment — a count that requires no proof of the underlying fraud at all.

Phase 1 — Engage counsel; establish privilege and the reporting structure

  • [ ] Retain outside white-collar counsel — not your commercial litigators, not your regulatory counsel, unless they genuinely do this work.
  • [ ] Decide who the client is: the company. Say so, out loud, in writing, repeatedly.
  • [ ] Establish a reporting line that preserves privilege: counsel reports to a special committee of the board or to the audit committee, not to the executives whose conduct is under review. See Corporate Governance and Fiduciary Duties: A Comprehensive Guide for Directors and Officers and Board Governance, Minutes, and Corporate Formalities: A Practical Checklist.
  • [ ] Route forensic vendors, accountants, and consultants through counsel under Kovel-style engagement letters so their work is privileged work product.
  • [ ] Label investigation materials "Attorney-Client Privileged / Attorney Work Product / Prepared at the Direction of Counsel" — and mean it. Labels do not create privilege; they document intent.
  • [ ] Restrict distribution. Every additional recipient is a waiver argument.
  • [ ] Stop the business-as-usual email thread about the investigation. Non-privileged executive chatter about the case is discoverable and devastating.

Why it matters, and the traps

Upjohn Co. v. United States, 449 U.S. 383 (1981), is the load-bearing case of corporate internal investigations: communications between company counsel and any employee — not just the "control group" — are privileged when the employee is communicating at the direction of superiors, about matters within the scope of their duties, for the purpose of obtaining legal advice for the company. Hickman v. Taylor, 329 U.S. 495 (1947), separately protects counsel's mental impressions as work product, and opinion work product enjoys near-absolute protection.

The trap: privilege that never attached. If the internal review is run by the compliance department "for business reasons," or if counsel's role is merely to receive a report already prepared by HR, a court may find the primary purpose was business, not legal — and the whole file becomes producible. The fix is structural: counsel directs the investigation from the first hour. The parallel is exact in the employment context; see Conducting a Workplace Investigation: A Practical Checklist.

Phase 2 — Employee interviews: rights, yours and theirs

  • [ ] Send a neutral, lawful communication to employees: (1) the company received legal process and is cooperating with its obligations; (2) preserve documents; (3) agents may contact you at home; (4) you may speak with them or decline — it is entirely your choice; (5) you may have a lawyer present; (6) if you do speak, tell the truth; (7) the company will not retaliate for either choice; (8) please tell the legal department if you are contacted, if you are comfortable doing so.
  • [ ] Do not script employees. Do not "prepare" them for agent contact. That is witness tampering territory (18 U.S.C. § 1512(b)).
  • [ ] Do not condition employment on refusing to speak or on reporting what was said.
  • [ ] Offer a "hotline" to counsel for employees who want to know their rights.
  • [ ] Track which employees are contacted — voluntarily reported, not compelled.
  • [ ] Watch for retaliation, which is a separate crime under 18 U.S.C. § 1513(e) and a separate civil claim under Sarbanes-Oxley § 806 (18 U.S.C. § 1514A) and the SEC whistleblower rules (15 U.S.C. § 78u-6).

Why it matters, and the traps

There is a razor-thin line between informing employees of their rights (lawful, and good practice) and discouraging them from cooperating (obstruction). Stay on the informing side of it, in writing, and let the writing speak for itself if it is ever read aloud to a jury.

Phase 3 — Subject, target, or witness?

  • [ ] Ask counsel to call the prosecutor or agency lawyer and ask directly. DOJ uses three categories (Justice Manual 9-11.151): a target is someone the prosecutor has substantial evidence linking to a crime; a subject is someone whose conduct is within the scope of the grand jury's investigation; a witness has information but is not in the crosshairs.
  • [ ] Ask the same question for the company and for each senior individual.
  • [ ] Ask what conduct, what time period, what statutes. You will not always get an answer. Ask anyway; the refusal itself is information.
  • [ ] Ask whether there is a parallel civil or administrative matter, and whether an FCA qui tam complaint is under seal.
  • [ ] Reassess after every production. Status changes. A witness becomes a subject the day a document surfaces.

Why it matters, and the traps

Everything — cooperation, self-disclosure, whether individuals need separate counsel, whether the Fifth Amendment is in play — turns on status. A company that thinks it is a witness and is actually a subject will produce documents cheerfully, waive things carelessly, and give interviews it should not have given.

Note also that agencies generally owe you no notice: SEC v. Jerry T. O'Brien, Inc., 467 U.S. 735 (1984), holds the SEC need not notify the target of an investigation that it is subpoenaing third parties about them. You may be the last to know.

Phase 4 — Notify insurers and evaluate disclosure obligations

  • [ ] Read the D&O policy today. Note whether it is claims-made-and-reported, and what the reporting deadline is.
  • [ ] Determine whether a subpoena or a "formal order of investigation" is a covered "Claim." Many modern policies expressly cover pre-claim investigation costs; older ones do not, and the difference is enormous.
  • [ ] Give notice — of the claim and, where available, of "circumstances." Late notice is the single most common way coverage is lost.
  • [ ] Check Side A coverage for individuals when the company cannot indemnify.
  • [ ] Do not let the carrier's panel-counsel preference override the need for real white-collar counsel — negotiate.
  • [ ] Evaluate securities disclosure (materiality under Basic Inc. v. Levinson, 485 U.S. 224 (1988)): does this require an 8-K, a risk-factor update, a loss contingency accrual, or disclosure in MD&A?
  • [ ] Evaluate contractual and regulatory notice duties: lenders, payors, licensing boards, government contracting officers, exchange listing rules.
  • [ ] If patient or personal data was seized or breached, run the separate notification analysis — see Responding to a Data Breach: A Notification and Incident Response Checklist and Data Breach Notification Law: A Comprehensive Guide.

Why it matters, and the traps

Insurance is state law, and coverage outcomes vary meaningfully by jurisdiction — on whether an informal SEC inquiry is a "Claim," on the reach of the fraud and personal-profit exclusions, and on how "final adjudication" language is applied. Teach yourself the framework in Insurance Coverage Law: A Comprehensive Guide for Policyholders, then execute Tendering a Claim and Preserving Coverage: A Policyholder's Checklist — and confirm your own state's rule rather than assuming a national one.

The trap: Dana at Vantage Meridian assumes the subpoena "isn't a claim yet" and waits four months to notice. The policy renews in the interim. The carrier denies on late notice and on the prior-knowledge exclusion in the new policy. Both defenses were avoidable with a two-page letter on day three.

Phase 5 — Scope and negotiate the production

  • [ ] Do not produce on the return date reflexively. Grand jury return dates are routinely extended by agreement.
  • [ ] Meet and confer with the AUSA or agency counsel. Bring a proposal: custodians, date range, search terms, data sources.
  • [ ] Negotiate down: narrow the date range, drop peripheral custodians, phase the production, substitute structured data extracts for full-text collections.
  • [ ] Get every agreement in writing (a confirming email is enough, and is essential).
  • [ ] Assess whether to move to quash. Under Fed. R. Crim. P. 17(c)(2), a court may quash a subpoena that is "unreasonable or oppressive," but United States v. R. Enterprises, Inc., 498 U.S. 292 (1991), sets a forgiving standard for the government: a grand jury subpoena is presumed valid, and the movant must show there is no reasonable possibility the material will produce information relevant to the investigation. Motions to quash rarely win and always antagonize. Weigh accordingly.
  • [ ] For administrative process, evaluate the Powell factors — legitimate purpose, relevance, not already possessed, procedural steps followed — and whether the agency is improperly using civil process for a criminal purpose.
  • [ ] Push back on personal devices and personal email only where you have a principled basis; the government hears reflexive resistance as consciousness of guilt.
  • [ ] Document what you did not produce, and why.

Why it matters, and the traps

Scope negotiation is where a $4 million production becomes a $700,000 production. It is also where credibility is built or destroyed. Prosecutors extend deadlines for counsel who deliver what they promised and never for counsel who did not.

The trap: over-producing to look cooperative. Dumping 900,000 documents you never reviewed does not buy credit — it buys a privilege waiver, an obstruction risk (if the dump is a haystack strategy), and a prosecutor who now has your bad documents and your privileged ones.

Phase 6 — Collect, review, and produce

  • [ ] Forensically collect — do not let custodians self-collect. Self-collection is indefensible and, in a criminal matter, dangerous.
  • [ ] Document chain of custody for every source.
  • [ ] Run a defensible review: responsiveness, privilege, and a hot-document track that routes bad facts to lead counsel same-day.
  • [ ] Do the privilege review carefully and log it. Build the log as you go, not at the end — see Building a Privilege Log: A Practical Checklist.
  • [ ] Seek a Fed. R. Evid. 502(d) clawback order (or an agency equivalent) so that inadvertent production is not waiver.
  • [ ] Bates-stamp, load-file, and produce in an agreed format, with a cover letter that describes the scope of the production and the sources searched.
  • [ ] Certify accurately. If the custodian must attest, make sure the attestation is true.
  • [ ] Produce on a rolling basis and tell the government when the last production will land.

Why it matters, and the traps

Note the Fifth Amendment reality that governs corporate production: a corporation has no Fifth Amendment privilege (Hale v. Henkel, 201 U.S. 43 (1906)), and under the collective-entity doctrine a custodian cannot refuse to produce corporate records on the ground that the act of production would incriminate him — Braswell v. United States, 487 U.S. 99 (1988); see also Bellis v. United States, 417 U.S. 85 (1974). The custodian's act of production cannot be used against him personally, but the records come out. An individual's own personal papers are a different analysis under Fisher v. United States, 425 U.S. 391 (1976), and United States v. Hubbell, 530 U.S. 27 (2000).

The trap: selective waiver. Most circuits reject the idea that disclosing privileged material to the government waives it only as to the government. Hand a privileged internal-investigation memo to the AUSA and you have very likely handed it to every civil plaintiff who follows. A Rule 502(d) order and a confidentiality agreement help; they do not reliably cure a deliberate disclosure. UpLaw's The Federal Discovery Toolkit: A Roadmap From Rule 26(f) to Sanctions maps the downstream civil consequences.

Phase 7 — The internal investigation and the Upjohn warning

  • [ ] Scope the investigation in writing before the first interview: what questions, what period, what will be reported and to whom.
  • [ ] Give a proper Upjohn warning at the start of every employee interview, and document that you gave it:
    • I am a lawyer for the company, not for you.
    • This conversation is privileged, but the privilege belongs to the company, not to you.
    • The company may choose, without asking you, to waive that privilege and disclose what you say to the government.
    • You should keep this conversation confidential so the company can protect the privilege.
    • (If applicable) You may wish to consult your own lawyer.
  • [ ] Do not blur the line. Never say "I'm here to help you" or "we're all on the same team."
  • [ ] Two lawyers in every interview; one takes notes framed as impressions, not a transcript.
  • [ ] Do not tape unless there is a compelling reason and both counsel agree.
  • [ ] Sequence interviews — documents first, peripheral witnesses next, principals last.
  • [ ] Report findings orally to the board committee where possible; write the written report last, and write it knowing it may someday be read by a jury.

Why it matters, and the traps

The Fourth Circuit's In re Grand Jury Subpoena: Under Seal decision (the "AOL" case) is the canonical warning: where company counsel gave a muddy warning and employees reasonably believed counsel represented them personally, the employees could assert a personal privilege — but the company's privilege still controlled disclosure, and the employees' statements went to the government anyway. Everyone lost. A clear Upjohn warning protects the company, protects the employee, and protects the lawyer's bar license.

The trap at Vantage Meridian: counsel interviews a billing manager, does not give a clean warning, and the manager describes what she was told to do by the VP of Revenue. Six months later the company decides to cooperate and disclose the interview memos. The manager, who thought the lawyer was her lawyer, moves to enjoin the disclosure. The motion probably fails — and the news story writes itself.

Phase 8 — Employee counsel, advancement, indemnification, and joint defense

  • [ ] Identify employees who need separate counsel: anyone whose conduct is in issue, anyone the government has identified as a subject, anyone whose interests may diverge from the company's.
  • [ ] Check the charter, bylaws, and indemnification agreements for mandatory vs. permissive indemnification and — critically — advancement of fees.
  • [ ] Understand the Delaware framework (the reference point for most U.S. corporations): DGCL § 145 permits indemnification of officers and directors who acted in good faith and in a manner reasonably believed to be in or not opposed to the corporation's best interests; § 145(c) makes indemnification mandatory for those successful on the merits; and § 145(e) authorizes advancement of expenses on an undertaking to repay if indemnification turns out not to be available. Delaware courts (e.g., Homestore, Inc. v. Tafeen (Del. 2005)) treat advancement as a distinct, contractual right decided summarily and independent of the merits — advancement is not a finding of innocence. Confirm your state of incorporation's statute; § 145 is the model, not a national rule.
  • [ ] Consider a joint defense / common interest agreement among the company and aligned individuals. Put it in writing. Define the common interest, the scope of shared material, the confidentiality obligations, and — most importantly — the exit provisions: what happens to shared information when a member leaves or begins cooperating.
  • [ ] Build the "pool counsel" structure carefully: separate counsel for groups of similarly situated, non-conflicted employees can be economical and lawful, but conflicts are real and must be waived knowingly.
  • [ ] Do not condition advancement on the employee's refusal to cooperate with the government. The government reads that as obstruction. Note also that DOJ policy no longer permits prosecutors to demand that a company cut off fee advancement as a price of cooperation credit; the Second Circuit's United States v. Stein (KPMG) litigation is why.

Why it matters, and the traps

Joint defense agreements are a double-edged sword. They let the company see what the individuals know. They also mean that when one individual flips — and someone usually does — the government will hunt for the crime-fraud exception and will argue that the JDA itself was a vehicle for coordinating a false story. Draft the exit provisions on day one, because you will need them.

Phase 9 — The cooperation decision

  • [ ] Read DOJ Justice Manual 9-28.000 (Principles of Federal Prosecution of Business Organizations) and understand the factors: the seriousness of the offense, pervasiveness of wrongdoing and management complicity, the corporation's history, timely and voluntary disclosure, the effectiveness of the compliance program, remediation, collateral consequences, and the adequacy of civil or regulatory remedies.
  • [ ] Understand what cooperation credit actually requires: identifying the individuals substantially involved in the misconduct and producing all relevant, non-privileged facts about them. Corporate cooperation credit is gated on individual accountability.
  • [ ] Distinguish facts from privilege. Cooperation requires disclosure of facts; DOJ policy states that waiver of attorney-client privilege and work product is not a prerequisite to cooperation credit. Do not let a prosecutor's "we'd like the memos" drift into a waiver you never had to give.
  • [ ] Model the alternatives with counsel: declination, non-prosecution agreement (NPA), deferred prosecution agreement (DPA), guilty plea, and — on the civil side — an FCA settlement with a corporate integrity agreement.
  • [ ] Price the collateral consequences honestly: exclusion from Medicare/Medicaid, suspension and debarment from federal contracting, license revocation, loss of financing covenants.
  • [ ] Get board authorization, documented, for whatever path you choose.

Why it matters, and the traps

Cooperation is not a mood; it is a transaction with defined terms and a defined price. Read White-Collar Crime and Corporate Criminal Liability: A Comprehensive Guide before you decide — it explains respondeat superior corporate liability, the sentencing-guideline credit for effective compliance programs, and how DPAs and NPAs actually work.

The trap: half-cooperation. A company that promises full cooperation, then slow-walks a custodian, then produces the bad emails in month nine, gets the worst of both worlds — no credit and a new obstruction theory. Decide, then execute completely. Note too that DOJ corporate-enforcement policy has been revised repeatedly across administrations; confirm the current Justice Manual and the current policy of the specific component before relying on any published formula.

Phase 10 — Self-disclosure

  • [ ] If you find misconduct the government does not yet know about, evaluate voluntary self-disclosure on a clock. Nearly every program requires disclosure "reasonably promptly" after discovery, and before an imminent threat of disclosure or a government inquiry.
  • [ ] Identify the right program: DOJ's Criminal Division Corporate Enforcement Policy (Justice Manual 9-47.120, originating in the FCPA context and extended more broadly); U.S. Attorney's Office voluntary self-disclosure policies; the HHS-OIG Self-Disclosure Protocol; CMS's Self-Referral Disclosure Protocol for Stark issues; SEC and CFTC cooperation frameworks. Requirements differ.
  • [ ] Understand the trade: prompt voluntary self-disclosure + full cooperation + timely and appropriate remediation + disgorgement generally yields a strong presumption of declination or a substantial penalty reduction — absent aggravating circumstances.
  • [ ] Check the overpayment clock in regulated industries. In healthcare, an identified overpayment must be reported and returned within 60 days or it becomes a False Claims Act obligation (42 U.S.C. § 1320a-7k(d)). See Healthcare Compliance: A Comprehensive Guide to HIPAA, Stark, and the Anti-Kickback Statute and HIPAA Compliance: A Practical Checklist.
  • [ ] Assume a whistleblower is already inside. Every self-disclosure calculus should be run against the question: if we do not disclose, when does the relator?

Why it matters, and the traps

For Vantage Meridian, this is the decision that matters most. If the internal review confirms that a regional lab billed medically unnecessary panels, the 60-day overpayment rule is running whether or not the criminal case resolves — and a refusal to repay converts a billing error into a knowing FCA violation with treble damages and per-claim penalties.

The trap: disclosing before you know what happened. A premature, inaccurate self-disclosure that you later have to correct destroys credibility and can itself be a false statement. Investigate fast — but disclose accurately.

Phase 11 — Parallel proceedings and the Fifth Amendment problem

  • [ ] Map every proceeding: grand jury, agency enforcement, qui tam, follow-on securities class action, derivative suit, state AG, licensing board, contract suspension.
  • [ ] Assume everything you say in one forum is usable in all the others.
  • [ ] Consider moving to stay the civil case pending the criminal one. Courts weigh the overlap of issues, the status of the criminal case (a stay is far more likely post-indictment), prejudice to the plaintiff, judicial economy, and the public interest. Stays are discretionary and frequently denied pre-indictment.
  • [ ] Understand the asymmetry: an individual who invokes the Fifth Amendment in a civil case may have an adverse inference drawn against him — Baxter v. Palmigiano, 425 U.S. 308 (1976) — a consequence that does not exist in the criminal case. The company may be crippled in the civil suit by its own executives' silence.
  • [ ] Evaluate immunity: use immunity under 18 U.S.C. §§ 6002–6003 bars use and derivative use of the compelled testimony (Kastigar v. United States, 406 U.S. 441 (1972)) but not prosecution from independent evidence. Proffer ("queen for a day") agreements are narrower still and their derivative-use carve-outs are dangerous — read them line by line.
  • [ ] Watch for improper government coordination: civil process used as a stalking horse for a criminal case can, in the right facts, support suppression or dismissal. Preserve the issue; it is rarely a winner.
  • [ ] Coordinate counsel across all forums so the same set of facts is told the same way everywhere.

Why it matters, and the traps

The IRS variant of this problem is instructive: a civil examination that is quietly referred to Criminal Investigation changes everything about how you respond, and the summons power is not a criminal investigative tool. See Handling an IRS Audit and Tax Controversy: A Comprehensive Guide for how that referral works and what to watch for. For the civil-side mechanics generally, Federal Civil Litigation: A Roadmap and Resource Guide is the map, and Defending the Witness on the Record: A Practical Checklist governs the deposition where the Fifth Amendment invocation will actually happen.

Phase 12 — Remediation and compliance enhancement

  • [ ] Fix the thing. Discipline or terminate the responsible individuals — documented, consistent, and defensible.
  • [ ] Repair the control failure that let it happen; do not just fire the person who exploited it.
  • [ ] Enhance the compliance program: risk assessment, policies, training, escalation, testing, and — the factor prosecutors actually probe — whether compliance has real authority and resources.
  • [ ] Claw back compensation where policy and law allow; compensation-based remediation is now an explicit factor in federal corporate enforcement.
  • [ ] Test the fix and document the test. "We updated the policy" is worth little; "we sampled 500 claims post-remediation and found zero recurrences" is worth a great deal.
  • [ ] Report remediation to the government — it is a live sentencing and charging factor, not a post-script.
  • [ ] Where trade secrets or systems were also compromised, run the parallel incident playbooks: When a Breach Hits Your Crown Jewels: A Trade Secret Incident-Response Checklist.

The worked example, end to end: how Vantage Meridian actually plays out

It is worth walking the whole hypothetical once, in sequence, because the checklist above is a set of parts and a real matter is a single continuous decision.

7:52 a.m., Tuesday. Dana Okoye walks to the lobby. The paper is a search and seizure warrant, not a subpoena — Attachment A names the Ohio headquarters and the billing floor; Attachment B lists claims data, physician-order documentation, and communications about "medical necessity" for a specific test panel, for a 30-month period. That single fact — warrant, not subpoena — dictates everything for the next six hours. There is nothing to negotiate and nothing to refuse; there is only observe, document, protect privilege.

7:54 a.m. Dana calls outside white-collar counsel from the lobby, not from her office, and puts counsel on speaker with the lead agent. She states, in front of the receptionist as a witness, that the company does not consent to any search beyond the warrant and will not obstruct, and that the company asserts attorney-client privilege and work product protection over the GC suite, the legal shared drive, and outside-counsel communications — and she identifies those locations physically. She asks whether a filter team is present. It is. She notes the name of the filter AUSA.

8:10 a.m. Employees are moved to the training room, with pay. The general counsel does not tell them what to say. She tells them the truth: agents may want to speak with you, here or at your home; you may speak with them or decline — that is entirely your choice; you may have a lawyer present; if you speak, tell the truth; the company will not retaliate either way. She does not collect their phones. She does not ask them to report back. Two employees choose to talk. One does not. Both choices are fine.

8:15 a.m. A billing supervisor, wanting to be helpful, tells an agent "we always got a physician order before billing." It is true of most claims and false as to roughly 2,000. That sentence is now a potential 18 U.S.C. § 1001 count, and Vantage Meridian's own production will eventually prove it false. This is the cost of a well-meaning employee talking without counsel — and it is exactly why the company's communication had to be neutral rather than encouraging or discouraging.

By noon. A written litigation hold is out. Email journaling is on, Teams message expiration is suspended, the 90-day backup rotation is frozen, the departing-employee laptop wipe queue is halted, and — the item most companies miss — the billing system and LIMS audit logs are preserved, because no email search will ever reach the structured data that actually shows what was ordered and what was billed. Custodians are over-included. Acknowledgments are collected.

Day 3. Notice goes to the D&O carrier — of the claim and of circumstances. This is the two-page letter that, in the version of this story where Dana waits four months for "something to actually happen," never gets written, and the carrier denies coverage on late notice and on the new policy's prior-knowledge exclusion. Insurance is state law; Ohio's rules on what constitutes a "Claim" and how strictly reporting conditions are enforced are the ones that govern here, and counsel confirms them rather than assuming a national rule.

Week 1. Counsel reaches the AUSA. The company is a subject, not a target. The VP of Revenue is a target. That single answer restructures the matter: the VP needs separate counsel immediately, the investigation must report to a special committee of the board rather than to management, and the interests of the company and its VP have already begun to diverge. A Kovel engagement brings in the forensic accountants under counsel.

Weeks 2–8. The internal investigation begins with documents, not people. Every interview opens with a clean Upjohn warning — I represent the company, not you; this is privileged, but the privilege is the company's; the company may waive it without asking you. The billing manager, properly warned, describes what she was instructed to do. Because the warning was clean, the company can later disclose that account without a motion to enjoin and without a disqualification fight.

Month 3. The review confirms the bad facts: a regional lab reflexively ran a full panel where the order supported a single test. Two clocks are now running at once. The criminal case has no deadline; the 60-day overpayment rule under 42 U.S.C. § 1320a-7k(d) does. An identified overpayment not reported and returned within 60 days becomes a False Claims Act obligation — turning a billing failure into a knowing FCA violation with treble damages. Vantage Meridian repays, discloses, and does so accurately, having first taken the time to know what actually happened. It cooperates fully — identifying the individuals involved and producing the facts — while declining to waive privilege over counsel's memoranda, which DOJ policy does not require it to waive.

The counterfactual. In the version where the IT director "archives" a mailbox that week to free storage, none of the above matters. The company now has a § 1519 problem, and § 1519 requires no proof of the underlying billing fraud at all. The prosecutor no longer needs to win the hard case. That is the whole lesson of this document.

Common Mistakes to Avoid

  1. Deleting anything. The single most destructive act available to you. § 1519 carries twenty years and requires no pending proceeding.
  2. Letting agents past the lobby on a subpoena. A subpoena is a demand for documents; it is not a warrant.
  3. Telling employees not to talk to the government. Obstruction risk, retaliation risk, and (for public companies) Rule 21F-17 risk — for zero benefit.
  4. Skipping or fudging the Upjohn warning. It costs thirty seconds and prevents a disqualification motion.
  5. Running the "investigation" out of compliance or HR without counsel directing it. The privilege never attaches.
  6. Sitting on the D&O notice. Late notice under a claims-made-and-reported policy is often fatal, and it is entirely self-inflicted.
  7. Over-producing to look cooperative. You buy waiver, not credit.
  8. Producing without a privilege log or a Rule 502(d) order.
  9. Assuming the custodian can plead the Fifth over corporate records. Braswell says otherwise.
  10. Advancing fees on the condition of silence. Never condition indemnification or advancement on non-cooperation.
  11. Half-cooperating. Choose a lane. The middle of the road is where you get hit.
  12. Self-disclosing before you know the facts — or discovering an overpayment and letting the 60-day clock run.
  13. Ignoring the civil case until the criminal case ends. It will not wait for you, and the adverse inference will be waiting when you get there.
  14. Writing the internal-investigation report as if no one will ever read it. Someone will.

The Consolidated Response Checklist

Hour 0–2

  • [ ] Read the document; classify it (grand jury subpoena / CID / administrative subpoena / search warrant).
  • [ ] Call outside white-collar counsel.
  • [ ] If a warrant: copy it, assert privilege on the record, shadow the agents, log everything, do not consent, do not obstruct.
  • [ ] Send employees to a safe room or home; tell them their rights, neutrally.

Day 1

  • [ ] Written litigation hold out; auto-delete suspended; personal devices and structured data covered.
  • [ ] Preserve the agents' cards, the warrant inventory, the cover letter.
  • [ ] Same-day memorandum of everything that happened.

Week 1

  • [ ] Board/audit committee briefed; special committee constituted if needed.
  • [ ] Privilege structure and reporting line set; vendors engaged through counsel.
  • [ ] D&O carriers noticed; other notice obligations mapped.
  • [ ] Counsel contacts the AUSA/agency: status (target/subject/witness), scope, deadline extension.
  • [ ] Employee-rights communication sent.

Weeks 2–8

  • [ ] Production scope negotiated and confirmed in writing; Rule 502(d) order sought.
  • [ ] Forensic collection; hot-document track live.
  • [ ] Internal investigation underway; Upjohn warnings given and documented.
  • [ ] Separate counsel and joint defense agreements in place; advancement resolved.
  • [ ] Rolling productions with privilege log.

Months 2–6

  • [ ] Cooperation decision made and board-approved.
  • [ ] Self-disclosure evaluated against the applicable program and any overpayment clock.
  • [ ] Parallel proceedings mapped; stay motion considered; Fifth Amendment strategy set.
  • [ ] Remediation executed, tested, and reported.
  • [ ] Compliance program enhanced and its effectiveness documented.

Primary Authority

Compulsory process

Obstruction and destruction of records

Privilege and the internal investigation

The Fifth Amendment and corporate records

Charging, cooperation, and indemnification

  • DOJ Justice Manual 9-28.000 (Principles of Federal Prosecution of Business Organizations); JM 9-11.151 (target/subject/witness); JM 9-47.120 (Corporate Enforcement Policy) — policy changes across administrations; confirm the current text
  • U.S.S.G. § 8B2.1 (effective compliance and ethics program) and Chapter 8 generally
  • Del. Gen. Corp. Law § 145 (indemnification; § 145(c) mandatory indemnification on success; § 145(e) advancement) — state law; confirm your state of incorporation
  • Homestore, Inc. v. Tafeen (Del. 2005) (advancement as an independent contractual right)
  • United States v. Stein (2d Cir. 2008) (government pressure on fee advancement)
  • 42 U.S.C. § 1320a-7k(d) (60-day overpayment rule); 31 U.S.C. §§ 3729–3733 (False Claims Act)
  • 15 U.S.C. § 78u-6 and SEC Rule 21F-17 (whistleblower protections; prohibition on impeding reports); 18 U.S.C. § 1514A (SOX § 806)

A note on what is federal and what is not

Most of this checklist is federal: the compulsory process rules, the obstruction statutes, the privilege doctrine as applied in federal court, the Justice Manual, and the Sentencing Guidelines all apply nationally. Three things in it are not:

  • Indemnification and advancement are creatures of the law of your state of incorporation. This document uses Delaware — DGCL § 145 — as the reference point because most large U.S. corporations are Delaware entities and Delaware's case law is the most developed. It is a model, not a national rule. Confirm your own state's statute and your own charter and bylaws.
  • Insurance coverage is state law, and outcomes on the questions that matter here — whether an informal inquiry or a subpoena is a "Claim," how strictly reporting conditions are enforced, the reach of the fraud and personal-profit exclusions — vary meaningfully by jurisdiction.
  • State investigations (state AGs, Medicaid Fraud Control Units, licensing boards) run on state process with state rules on privilege, secrecy, and quash standards. The structure of the response is the same; the authority is not.

Secondary Sources

  • DOJ Justice Manual, Title 9 — particularly JM 9-11.000 (grand jury), JM 9-28.000 (Principles of Federal Prosecution of Business Organizations), and JM 9-47.120 (Corporate Enforcement Policy). Corporate enforcement policy is revised across administrations; always confirm the current text and the current policy of the specific component.
  • U.S. Sentencing Guidelines Manual, Chapter 8 (Sentencing of Organizations), especially § 8B2.1 (effective compliance and ethics program) and § 8C2.5 (culpability score; credit for self-reporting, cooperation, and acceptance of responsibility).
  • HHS-OIG Self-Disclosure Protocol and CMS Self-Referral Disclosure Protocol — the healthcare-specific disclosure vehicles, with different eligibility and different consequences.
  • ABA Model Rules of Professional Conduct — Rules 1.13 (organization as client), 4.3 (dealing with unrepresented persons; the professional-responsibility foundation of the Upjohn warning), and 1.7 (conflicts, for pool-counsel and joint-defense structures).
  • Restatement (Third) of the Law Governing Lawyers §§ 73, 87–93 (entity privilege and work product).
  • Wright & Miller, Federal Practice and Procedure (grand jury practice and Rule 17); Weinstein's Federal Evidence (Rule 502 and waiver).

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This checklist is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Laws vary by state and change over time; verify current requirements and consult qualified counsel before acting. If your company has received a government subpoena or a search warrant, engage experienced white-collar defense counsel immediately — the first forty-eight hours are not the time to learn this material.