Compliance-Legal-Risk Triage
Classify every restriction before deciding how to respond
- Difficulty
- Easy
- Time to result
- ~days to results
- Steps
- 5
- Confidence
- 94%
Organizations often use “compliance” as a catch-all explanation for rejecting activity, even when the actual concern is contractual liability or discretionary business risk. This framework begins by defining the proposed activity and tracing the objection to its source. The team then classifies the matter as a regulatory requirement, a legal issue, or a risk-management decision. That classification determines the response: satisfy a rule, obtain legal analysis, or make an explicit risk-reward choice. Separating the categories also clarifies who owns the decision and prevents internal teams from hiding business preferences behind regulatory language. The output is a documented decision grounded in the real constraint rather than an automatic no.
Origin
Extracted from Masters in Business, where Brian Hamburger explains how advisors leaving large firms must unlearn the tendency to treat compliance, legal obligations, and risk mitigation as one indistinguishable category.
Core principles
- 01A restriction's label may conceal its real purpose
- 02Compliance, legal exposure, and business risk require different responses
- 03Rules should be traced to their source rather than accepted as unexplained policy
- 04Risk tolerance is a management decision, not automatically a regulatory mandate
How to run it
- 1
Define the activity
Describe exactly what the business wants to do, who is involved, and what outcome it seeks. Avoid deciding from a vague summary.
Pro tip Write the activity as a concrete transaction or communication rather than a general ambition.
Watch out An imprecise proposal encourages an imprecise prohibition.
- 2
Trace the objection
Ask which regulation, contract, policy, or risk concern is being invoked. Return to the underlying source whenever possible.
Pro tip Request the specific provision and the facts that make it relevant.
Watch out Do not assume an internal policy is legally mandatory.
- 3
Classify the constraint
Place each concern into compliance, legal, or risk. Split mixed concerns into separate entries rather than forcing one label onto the whole matter.
Pro tip Assign an owner with expertise and authority for each category.
Watch out A single issue may contain all three categories.
- 4
Choose the proper response
Meet mandatory compliance requirements, obtain counsel on legal exposure, and explicitly evaluate discretionary risk. Look for a lawful alternative when the original route is unavailable.
Pro tip Record which elements are non-negotiable and which are management choices.
Watch out Do not treat risk appetite as permission to violate a rule.
- 5
Document and monitor
Record the rationale, conditions, approvals, and accountable owner. Revisit the decision if facts, regulations, or business practices change.
Pro tip Use the classification in future reviews so similar cases are handled consistently.
Watch out An undocumented exception can become an uncontrolled precedent.
In the wild
An RIA's campaign is rejected as a compliance problem. The team identifies one required disclosure, a legal concern about an unsupported claim, and a separate reputational concern about tone. It adds the disclosure, substantiates the claim, and lets management decide whether the reputational risk is acceptable.
→ The firm launches a modified campaign without confusing discretionary caution with legal prohibition.
An advisor preparing to leave a broker-dealer inventories employment covenants, securities rules, and the firm's enforcement history. Counsel distinguishes activities requiring consent from permissible planning and business risks surrounding the transition.
→ The advisor follows a defensible transition path rather than relying on a blanket assumption that all preparation is forbidden.
Common mistakes
Calling every concern compliance
A catch-all label obscures whether the issue is mandatory, contractual, or simply a conservative business preference.
Accepting an unexplained no
A decision cannot be evaluated intelligently until the underlying rule, agreement, or risk has been identified.
Ignoring mixed constraints
Solving the regulatory component does not automatically resolve contractual liability or business risk.
Is it for you?
Best for
It is best for leaders, advisors, and compliance teams evaluating unfamiliar activities in regulated businesses.
Not ideal for
It is not a substitute for qualified counsel when litigation, enforcement, or complex legal rights are involved.
From the transcript
“And so as advisors look to leave these big enterprises and go independent, one of the biggest things that we need to train them on…”
“Compliance, legal and risk. Those are three very very distinct issues that sometimes get lumped together as a lazy way to say no exactly really…”
“They couldn't go back to the source, They couldn't go back to the root, They couldn't rationalize why things were being done that way.”
From the episode
Brian Hamburger on Surging Merger Business in RIAs
Brian Hamburger