Credit Where It’s Earned: How Regulators Are Weighing Compliance Programs When Setting Penalties

October 22, 2026

Federal enforcers have spent the past year tying the penalties companies face more closely to the strength of their compliance programs. In March 2026, the U.S. Department of Justice (DOJ) issued its first Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP). In April 2026, the U.S. Department of Health and Human Services Office of Inspector General (OIG) unveiled a modernized Corporate Integrity Agreement (CIA) template. And on October 1, 2026, DOJ’s new National Fraud Enforcement Division (Fraud Division) issued Directive 26-12, which makes health care fraud a top corporate enforcement priority. Read together, these developments show that regulators are looking beyond the existence of a compliance program to evidence that it works and guides the company’s response when problems surface.

For medical device, diagnostics, and biotechnology companies, the message is clear. A compliance program is no longer a background consideration. It can shape whether the government declines to prosecute, how large a fine is, whether a monitor is imposed, and what obligations follow a resolution. This alert walks through the current landscape and the practical steps companies should be taking now.

Compliance Programs Remain Central to How DOJ Sets Penalties

DOJ’s Evaluation of Corporate Compliance Programs (ECCP), last updated in September 2024, remains the framework prosecutors use to assess a company’s program. DOJ states that the ECCP is meant to help prosecutors decide three things: the form of any resolution or prosecution, the monetary penalty, if any, and the compliance obligations in any resolution, such as a monitorship or reporting requirements. The U.S. Sentencing Guidelines likewise consider whether an effective compliance program was in place when calculating an organizational fine.

The ECCP is organized around three core questions: Is the program well designed? Is it adequately resourced and empowered to function effectively? Does it work in practice? Prosecutors assess the program's effectiveness both at the time of the offense and at the time of a charging decision or resolution, and they consider the company's efforts to implement or improve its compliance program.

DOJ’s Department-Wide CEP Ties Outcomes to Disclosure, Cooperation, and Remediation

The CEP, announced March 10, 2026, applies to all corporate criminal matters handled by DOJ except certain antitrust violations, and it supersedes the prior component-specific and U.S. Attorney’s Office-specific policies. It creates three resolution paths:

Part I: Declination. DOJ will decline to prosecute if the company voluntarily self-disclosed to a DOJ criminal component, fully cooperated, timely and appropriately remediated, and there are no aggravating circumstances. The company must still pay disgorgement, forfeiture, and restitution, and declinations are made public.
Part II: “Near miss” resolutions. If a company falls short of a declination only because its good-faith self-report did not qualify as a voluntary self-disclosure or because of aggravating factors, DOJ will offer a non-prosecution agreement absent particularly egregious or multiple aggravating circumstances. That agreement will run less than three years, will not include an independent compliance monitor, and will provide a 50% to 75% reduction off the low end of the Sentencing Guidelines fine range.
Part III: Other cases. Prosecutors maintain discretion to determine the appropriate resolution for companies that do not qualify under Parts I or II.

The CEP also includes an appendix that defines “timely and appropriate remediation” in detail. In practice, credit depends on a company’s ability to show how the issue was detected, when decision makers learned of it, why the misconduct occurred, and what the company changed to prevent it from happening again. In announcing the policy, DOJ leadership also identified the overuse of compliance monitors as a problem the new policy was intended to address.

Directive 26-12 Raises the Stakes for Health Care Companies

The National Fraud Enforcement Division was created in April 2026 and took over several components from DOJ’s Criminal Division, including the Health Care Fraud Unit. Directive 26-12 names health care fraud, unlawful distribution of controlled substances, and violations of the Federal Food, Drug, and Cosmetic Act among its corporate investigative priorities. It directs prosecutors to follow the CEP in every case and reaffirms that DOJ will prosecute companies when wrongdoing is serious and pervasive and the company’s compliance policies, internal controls, and history of misconduct show that it caused or encouraged the offense. At the same time, the Directive commits to guarding against overbroad corporate enforcement and to crediting companies that disclose, cooperate, and remediate.

The Directive instructs prosecutors to give “great weight” to ten factors when deciding whether to charge a company or how to structure a resolution. Several relate directly to how well a compliance program detects and escalates problems, including:

Management knowledge of or participation in the misconduct;
Efforts to conceal the fraud from regulators or obstruct government oversight;
Conduct lasting three years or longer;
Substantial financial harm to taxpayer-funded programs or conduct affecting multiple such programs; and
Conduct affecting three or more federal districts, 25 or more victims, or losses of $25 million or more.

The Directive also routes all Fraud Division corporate investigations through a new Corporate Enforcement Section, which has primary responsibility for monitoring compliance with corporate resolutions. It further instructs Division leadership to develop whistleblower incentive programs. Combined with the Division’s data analytics efforts, these programs may shorten the time companies have to identify and self-report misconduct before the government learns of it independently.

OIG’s Modernized CIA Template Shows What “Effective” Looks Like

On the civil side, OIG often requires a Corporate Integrity Agreement as part of a False Claims Act resolution, and, in exchange, agrees not to seek the company’s exclusion from federal health care programs. On April 30, 2026, OIG presented an updated CIA template at the Health Care Compliance Association’s annual Compliance Institute, using the Kinex Medical Company CIA, executed March 2, 2026, as its model. The template is designed to codify the principles in OIG’s General Compliance Program Guidance (GCPG). Key enhancements include:

An independent compliance officer. The compliance officer must report directly to the CEO or the board, have direct and independent board access, and may not lead or report to the legal or finance functions or hold operational responsibility for areas such as billing, coding, claims submission, or contracting.
Active board oversight. The board must meet at least quarterly in executive session with the compliance officer, without management present, and must engage an independent compliance expert to evaluate the program’s effectiveness. The board’s response to the expert’s findings is included in annual reports to OIG.
Broader internal reporting. The “disclosure program” now captures reports made to compliance through any channel, including emails and manager escalations, not just a hotline.
Technology and AI oversight. The compliance committee must include information technology expertise, and new CIAs include a formal definition of generative AI and related reporting requirements.

A CIA binds only the company that signs it. Even so, OIG has long used CIAs to signal its expectations to the broader industry, and companies should treat the updated template as the current benchmark for what OIG considers an effective compliance program.

What Trends Should Companies Be Watching?

Across DOJ and OIG, several consistent themes are emerging in how regulators evaluate compliance programs when deciding on penalties:

Effectiveness over existence. A program that exists only on paper earns little credit. Regulators want evidence that the program is resourced, used, tested, and improved over time.
Speed of detection and disclosure. Whistleblower incentives and government data analytics are narrowing the window to self-report. To qualify as a voluntary self-disclosure under the CEP, a company must disclose to the appropriate DOJ criminal component reasonably promptly, before DOJ is aware of the misconduct and before an investigation or disclosure is imminent.
Documented remediation. Root cause analysis, discipline, and control changes must be timely and well documented to support declination or penalty reduction.
Independence and board engagement. Regulators increasingly expect a compliance officer with meaningful authority and a board that actively oversees the program.
Individual accountability. To receive cooperation credit, companies are expected to provide information about the conduct of specific individuals, regardless of seniority.
Emerging technology. OIG's updated CIA template now defines generative AI, requires reporting on its use, and calls for information technology expertise on the compliance committee. While these terms bind only CIA parties, they signal that OIG may increasingly look at how companies oversee AI.

“Regulators are no longer giving credit simply for having a compliance program. They want to see a program that is independent, well resourced, and able to catch problems early, along with records showing the company acted when issues came up. Companies that invest in that now are in a much stronger position if a problem ever arises.”
Vivian Egbu, Associate Attorney

Practical Takeaways for Medical Device and Biotech Companies

Companies should treat the current environment as a reason to test their programs before regulators do. Benchmark the program against the ECCP and the updated CIA template, not just the GCPG’s seven elements. Confirm that the compliance officer has independent reporting lines and is not carrying conflicting operational duties. Make sure the board receives regular, direct compliance reporting. Track every internal report, whatever channel it comes through. Establish a clear process for escalating potential misconduct quickly enough to preserve the option of self-disclosure, and document investigations, root cause findings, and remediation steps as they happen so the record is ready if the government asks.

Bottom Line

Regulators are drawing a sharper line between companies that can demonstrate an effective compliance program and those that cannot. DOJ’s Department-wide CEP links declinations, fine reductions, and monitor decisions to self-disclosure, cooperation, and remediation. Directive 26-12 places health care fraud at the top of DOJ’s corporate fraud agenda, and OIG’s updated CIA template signals heightened expectations for independence, board oversight, and technology governance. Companies that can show their programs work in practice will be best positioned to reduce their exposure if a problem arises.

How Gardner Law Can Help

Gardner Law regularly advises medical device, diagnostics, digital health, and biotechnology companies on compliance program design and assessment, compliance officer and board reporting structures, internal investigations, self-disclosure decisions, and Anti-Kickback Statute and False Claims Act risk. We help companies benchmark their programs against current DOJ and OIG expectations and build the documentation regulators look for. Please contact us to discuss how these developments may affect your compliance program.