What to Do After You Discover a Compliance Violation

When you discover a compliance violation inside your business, the first few days set the tone for everything that follows. Stop the conduct, preserve the records, get counsel involved before anyone writes a long email about what happened, and only then decide whether the company has to report it or should choose to. The most damaging mistakes in this window are usually well meant: a manager confronts the employee and wipes out the evidence trail by accident, or someone sends a candid explanation to a regulator before anyone knows the full facts.

Our legal compliance and risk management attorneys handle this sequence for companies that need to move quickly without making the problem worse. Here is the order we follow.

Step 1: Stop the conduct and contain the harm

If the problem is ongoing, end it. That might mean suspending a billing practice, pulling a product claim from your website, freezing a payment to a third party, or cutting off a contractor’s system access. Containment does not require deciding who is at fault. It does require acting quickly, because continuing the conduct after you know about it changes how regulators and courts see it: a mistake becomes a knowing violation.

If the issue involves a data breach, containment includes technical steps by your IT team or an outside forensic firm, and notification deadlines may already be running. Every state has a breach notification law, and the deadlines and recipients differ.

Step 2: Preserve documents and data

Once a company reasonably anticipates litigation or a government inquiry, it has a duty to preserve relevant evidence. Suspend automatic deletion for the relevant email accounts, chat channels, and shared drives, and send a written preservation notice to the people involved. Do not let anyone clean up files, even with good intentions. Destroyed evidence can lead to court sanctions and can turn a manageable problem into an obstruction issue. Our guide on when a business must issue a litigation hold covers the mechanics.

Step 3: Investigate under counsel’s direction

Before you decide anything else, find out what happened, how long it went on, who knew, and how much harm it caused. Have counsel direct the investigation so that interviews, analysis, and conclusions have the best chance of staying privileged. The facts themselves are never privileged, but counsel’s analysis of them can be. We explain how to set this up in our post on privilege in internal investigations.

Keep the investigation proportionate. A one-time error on a single invoice does not need the same process as a pattern of false certifications to a government customer.

Step 4: Must you report the compliance violation?

These are two different questions.

Mandatory reporting

Some obligations require disclosure on a deadline. Examples include data breach notices to affected individuals and sometimes to state attorneys general, the federal contractor duty to disclose credible evidence of certain fraud and false claims violations, and reporting conditions built into licenses and permits in regulated industries. Contracts can also require you to notify customers or lenders of a violation of law. Counsel should map every obligation that applies, because missing a mandatory report is often worse than the original problem.

Voluntary self-disclosure

Many agencies give credit for coming forward. The Department of Justice’s corporate enforcement policy rewards voluntary self-disclosure, cooperation, and remediation. OFAC treats voluntary self-disclosure of sanctions violations as a significant mitigating factor, and export control and tax authorities have their own disclosure paths. Self-disclosure is a strategic choice: it can reduce penalties, but it guarantees the agency learns of the issue and may invite a broader review. Make that call with the full facts and counsel’s advice, not in the first week.

Step 5: Fix the cause, not just the incident

Regulators and courts care about what you changed. Remediation usually includes:

• Repaying or crediting anyone harmed, such as customers who were overcharged or employees who were underpaid.
• Disciplining the people responsible, consistent with past practice.
• Changing the process that allowed the problem: an approval step, a system control, a revised policy, or training for the team involved.
• Documenting what was done and when, so you can prove it later.

Be careful if the person who raised the issue is an employee. Federal and state laws protect many kinds of whistleblowers from retaliation, and a retaliation claim can outlast the underlying violation.

Step 6: Feed the lessons back into your program

A violation is a test of your compliance program. Ask why existing controls did not catch it sooner and whether similar risks exist elsewhere in the business. If the company had no real program, this is the moment to build one; our guide to small business compliance program elements is a practical starting point.

If the matter is likely to end in a dispute with a customer, partner, or former employee, bring in litigation counsel early. Capitol Law Partners’ commercial litigation and dispute resolution team works alongside the compliance side so the investigation record supports the company’s position later.

If your company has just found a compliance problem and needs to decide what comes next, Capitol Law Partners can help you contain it, investigate it, and weigh disclosure. Schedule a consultation.

This article is for informational purposes only and does not constitute legal advice. No attorney-client relationship is formed by this communication.

Attorney Cagatay Ersoy. Practical strategy for founders, investors, and growing companies.

Need help with this topic? See our corporate compliance and risk management page or schedule a consultation.