Caveat: if the punishment does not exceed the profit from cheating, it's not a punishment it's a cost of doing business.

See: Johnson & Johnson w/ their drug risperdal: $2 billion in penalties... $30 billion in sales.

http://www.nytimes.com/2015/09/17/opinion/nicholas-kristof-w...

That's a poor comparison. Not all of the $30B in sales were fraudulent.

Actually, in order to come up with the $2B penalty, the gov't determines the number of fraudulent Rxs, then hits the manufacturer with triple damages (this is typical).

J&J would have been better off financially had they never committed the fraud they did.

You need to account for the probability of being caught. It's quite likely to be significantly lower than 1/3, so they might still have come out ahead.

Even if they're just breaking even, it's a kind of loan - they had the gain a long time ago, and pay the costs much later. If you're a risky business, that's potentially worth a lot, since investors might be hard to find.

And if you account for that you need to account for the asymmetry of risk due to bankruptcy protections - even if the average payout is negative, fines are effectively capped at what the firm can pay, so the effective expected payout may still be positive. (Assuming those making this decision escape personal liability).

You forgot to multiply the cost if caught by the chance to be caught.

Of course it is. Companies usually behave rationally with regards to regulation and punishment. If the cost of breaking the rules is lower than the cost of following them, companies will break the rules. If you increase the cost of breaking the rules such that the situation is reversed, then companies will follow the rules.