Early Design Partner: A 45-Person Advisory Firm Moves From Spreadsheets to Automated Off-Channel Capture

A US-based investment advisory firm of roughly 45 people managed its communications compliance the way many firms its size do: email was archived, and everything else was governed by a spreadsheet. Staff periodically attested, in that spreadsheet, that they used only approved channels. The firm engaged with us as an early design partner to replace that manual, trust-based process with automated capture of the channels it had not been archiving. This account describes the change in process and controls. It does not attach performance metrics, because at this stage there are none the firm and we would both stand behind as validated.

The firm’s exposure was structural, not behavioural. Its archive covered email well and covered nothing else. Chat, SMS, and mobile messaging were governed only by periodic self-attestation in a spreadsheet. A spreadsheet attestation is a record that someone said they complied; it is not a record of the communications themselves. If a business conversation happened on an unarchived channel, the spreadsheet could not capture it, and no later review could recover it.

This is precisely the capture gap that US enforcement has turned into penalties. The off-channel actions punished firms for not retaining business communications under Rule 17a-4, and the 2024 round reached beyond the largest institutions to smaller registrants (SEC Release 2024-144). For a 45-person advisory firm, a spreadsheet standing in for an archive is the recognisable shape of that risk, the same problem we describe in why smaller firms are exposed.

The redesign was narrow by intent: close the capture gap before adding anything on top of it. Working with the firm, the engagement inventoried the channels staff actually used, rather than the channels policy assumed; connected the previously unarchived channels to a compliant, retrievable store, so capture no longer depended on self-attestation; replaced the spreadsheet attestation log with an automated capture record plus an exception log, so the firm reviews exceptions a system surfaces rather than re-certifying everyone by hand; and kept a named person accountable for reviewing exceptions and for the overall control.

At this stage the firm and we are comfortable reporting the change in controls, stated as before-and-after process states rather than performance numbers. We are not publishing hour, cost, or percentage figures. The engagement is early, and any such number would be provisional; we would rather show the control change we are confident in than a metric we are not.

This account is based on the design-partner engagement itself: the channel inventory, the systems connected, and the control that replaced the spreadsheet. Statements are limited to changes the firm has implemented and confirmed. Where a claim would require a measured outcome, time saved, alerts triaged, cost reduced, it has been omitted rather than estimated. The regulatory framing draws on the public rules and enforcement record cited above.