Preparing for a regulatory dawn raid

Unannounced inspections are designed to find organisations unprepared. The first hour is usually decisive: who meets the inspectors, whether the scope of their authority is checked, and whether staff understand what they must do and what they need not do.

A good protocol is short. It names a lead contact at each site, sets out who calls external counsel, explains how privileged material is identified and set aside, and reminds staff not to destroy documents, discuss the inspection or speculate in front of the inspectors. Reception teams, IT staff and senior assistants need to know it as well as the legal department does.

Rehearsal turns a document into a habit. A realistic exercise once a year, including the handling of phones, laptops and remotely stored data, reveals the gaps while they are still cheap to close.