The lengthy fraud enforcement actions following the 2008 Troubled Asset Relief Program (TARP) will be the template for the federal government's enforcement efforts following the CARES Act, including the PPP.

The CARES Act establishes the office of the special inspector general for pandemic recovery (SIGPaRc), an office with a dual mandate: to oversee the administration of the CARES Act and related relief efforts, and to investigate non-government actors to recover money the government has committed to the program. If the past is prologue, SIGPaRc will work with the criminal and civil divisions of U.S. Attorney's Offices (and inspector generals from at least five other agencies), employing a collection of effective tools including the False Claims Act (FCA) and selected criminal statutes. And where the SIGPaRc believes there is criminal fraud, prosecutors can use traditional false statement and fraud-based statutes to pursue the mandate of punishing those who abuse the relief programs.

What are the five pitfalls any company accessing CARES Act relief should know to avoid later enforcement action?

Pitfall 1: Failing To Master the Program

A company seeking relief must have a clear understanding of the eligibility and compliance requirements of the CARES Act—and of the representations the company makes.

With the benefit of hindsight, today's decisions will be scrutinized for accuracy and compliance. The CARES Act contains a host of certifications by recipients including that the applicant qualifies for the funds and that the funds will be used in compliance with the program. Certification liability is an effective and streamlined approach to fraud investigations where the government alleges the recipient violated the FCA when it falsely certified it was in compliance with all applicable laws, regulations and contract terms.

Certification liability is ongoing. Companies have continuing obligations to ensure initial representations remain accurate and, if not, that they are corrected. An accurate statement at the time of application may not be accurate when the proceeds are received. A false statement on an application could well be the basis for investigation and prosecution for false statement (18 U.S.C. §1001), wire or bank fraud (18 U.S.C. §§1343, 1344), or money laundering (18 U.S.C. §1956).

With the FCA's whistleblower provisions—offering a bounty for those who uncover misuse—investigations can start from anywhere. If you learn a mistake has been alleged—in application, compliance, administration—it is critical that the company investigate and quickly respond.

Even where there is little basis for the complaint, investigators and prosecutors will recognize a proper corporate response, as they will an effort to hide or minimize a mistake.

Pitfall 2: Forgetting To Update Your Company Compliance Program

A key to minimizing these enforcement risks is to follow a strong compliance program. Your company likely has a robust compliance program in place, but those policies were written with an on-site workplace in mind and may, therefore, need updating to accommodate a new work-from-home environment.

For example, if your policy directs employees to dial a work phone number to report incidents, employees may assume that line is not monitored during work-from-home hours. Consider instituting a 24-hour hotline for incident reporting.

In an effort to facilitate a work-from-home environment, many companies relaxed some of their more stringent compliance requirements, such as requiring paper receipts and paper signatures. Your risk manager should evaluate alternative requirements to ensure proper internal controls are maintained while your workforce remains off-site.

Don't forget to review your crisis management plan. The COVID-19 crisis has taught us that crisis management plans should include information on sanitation procedures, social distancing requirements and travel policies.

Pitfall 3: Forgetting the Records—Build Your Exhibit List NOW

Maya Angelou once said, "Hoping for the best, prepared for the worst, and unsurprised by anything in between." This guidance is ideal for any company participating in and managing relief from the CARES Act.

One lesson of the TARP enforcement experience is that investigators will have the luxury of time and 20/20 hindsight, so decisions made today will be autopsied years from now.

To prepare, begin building a record—and your defense—now. This means documenting, recording and retaining evidence of the entire process, from application, to information collection to administration to compliance and audit.

Did you seek guidance from your bank or from SBA? Document it.

Did you talk to a lender who explained their interpretation of a program element? Confirm it with an email and save the conversation.

Every piece of information that supports your deliberative and careful internal process should be available to you going forward.

This may also mean making adjustments to internal information and document management systems to avoid automatic deletion of communications and other materials that may be important to support the decisions your company is making now. Do not rely on your lender or the government agency you are dealing with to have or maintain such records; that responsibility is on your company.

Many companies are designating a specific person to manage the collection and maintenance of all CARES Act related activity.

Pitfall 4: Inadequate Internal Guidance to Employees

Company leadership sets the tone for company behavior. Executive messaging to employees should underscore that your company understands that the crisis is serious, and that it does not take lightly its obligations under the stimulus program. Encourage your employees to ask questions about the program, and be honest and direct in your responses.

Whistleblower complaints and qui tam actions fester in corporate environments that foster misinformation and secrecy.

Pitfall 5: Establish or Refine Your Communication Plan

Optics matter. Regulators, prosecutors and juries will not be sympathetic to recipients perceived to have taken advantage of the COVID-19 crisis. You should keep a tight hold on internal and external communications regarding the programs and the money, and communications should reflect the company's thoughtful approach to the crisis.

An email joking about "free money" will be Exhibit A in any subsequent civil or criminal litigation. A well-thought-out communication policy will avoid unplanned and potentially binding statements by company representatives, and can manage information communicated to your employees, to your stakeholders, to the media, and to the public. Capture, archive and supervise all written business communication about the stimulus, and in doing so, don't forget about text messages, instant messages, social media and collaboration tools, like Slack and Teams.

Pat McInerney is a partner in the Spencer Fane white-collar and government investigations practice. He is a former state and federal prosecutor with over two decades of experience as a trial lawyer, handing business disputes, health care and tax fraud, commercial merchandising practices act violations, criminal trade secret violations, and general criminal violations and civil disputes.

Carly Duvall is of counsel in the Spencer Fane white-collar and government investigations practice. She focuses her practice on conducting internal investigations and advising clients facing serious legal jeopardy such as allegations of fraud, embezzlement, and conversion.