{"id":13701,"date":"2025-12-23T20:04:59","date_gmt":"2025-12-23T20:04:59","guid":{"rendered":"https:\/\/www.comply.com\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/"},"modified":"2025-12-23T20:11:12","modified_gmt":"2025-12-23T20:11:12","slug":"your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking","status":"publish","type":"resource_posts","link":"https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/","title":{"rendered":"Your Compliance Program Needs More Tradecraft and Less Checkbox Thinking"},"content":{"rendered":"

By: Amber Tatman<\/strong>
\nSr. Director, Compliance Advisory Services
\nComply<\/span><\/p>\n

When I tell people I\u00a0studied\u00a0intelligence\u00a0for years before\u00a0becoming a\u00a0compliance\u00a0consultant,\u00a0they\u2019re\u00a0often\u00a0baffled by my\u00a0interest\u00a0in\u00a0these\u00a0seemingly disparate\u00a0areas. Yet,\u00a0after\u00a0years in\u00a0compliance,\u00a0I’ve\u00a0realized that\u00a0the disciplines of\u00a0intelligence\u00a0and compliance\u00a0share\u00a0much of the same\u00a0DNA.\u00a0\u00a0<\/span><\/p>\n

<\/span>Need-to-Know and Need-to-Show<\/span><\/b>\u00a0<\/span><\/span><\/h2>\n

The intelligence\u00a0profession\u00a0operates\u00a0on “need-to-know” principles: restrict information to those who\u00a0require\u00a0it; in compliance, data protection\u00a0and systems\u00a0entitlements\u00a0should\u00a0follow the same principles. However, compliance also\u00a0operates\u00a0by\u00a0a slightly\u00a0different principle: “need-to-show.” Advisers must be able to\u00a0demonstrate\u00a0adherence to rules and procedures.\u00a0\u00a0The\u00a0overarching\u00a0framework is\u00a0similar\u00a0because, among other things,\u00a0both disciplines require:<\/span>\u00a0<\/span><\/p>\n

    \n
  • Collecting relevant information without drowning in noise;<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
      \n
    • Synthesizing insights from multiple sources;<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
        \n
      • Analyzing information for patterns and gaps;<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
          \n
        • Continuously updating assessments as conditions change,\u00a0and<\/span>\u00a0<\/span><\/li>\n<\/ul>\n
            \n
          • Testing.<\/span>\u00a0<\/span><\/li>\n<\/ul>\n

            <\/span>Your\u00a0Cover Story<\/span><\/b>\u00a0<\/span><\/span><\/h2>\n

            Every\u00a0intelligence\u00a0officer\u00a0needs a cover story:\u00a0a coherent, defensible narrative that holds up under scrutiny. Your compliance program is your cover story.\u00a0Examiners\u00a0don\u2019t\u00a0check\u00a0boxes; they test whether your narrative is coherent, consistent, and supported by evidence.\u00a0Many advisers\u00a0describe\u00a0impressive portfolio management and research capabilities,\u00a0but\u00a0that story\u00a0doesn\u2019t\u00a0always translate cleanly into documented practice.\u00a0\u00a0Intelligence professionals call this “cover for\u00a0status\u201d,<\/span>\u00a0<\/span>maintaining\u00a0appearances without substance. It works until someone presses hard enough.<\/span>\u00a0<\/span><\/p>\n

            The\u00a0Tradecraft<\/span><\/b>:\u00a0To\u00a0maintain\u00a0regulatory readiness, stress-test your \u201ccover story.\u201d\u00a0Engage\u00a0an expert\u00a0to\u00a0conduct a mock\u00a0examination;\u00a0if they can poke holes in your story,\u00a0so can examiners.\u00a0Prepare\u00a0presentations\u00a0explaining\u00a0unusual or high-risk areas\u00a0so you\u00a0can\u00a0give\u00a0examiners\u00a0the lens through which to view your firm.\u00a0Make it easy for examiners to understand your program\u00a0and\u00a0believe\u00a0your cover\u2014if you\u00a0don\u2019t,\u00a0they\u2019ll\u00a0have to\u00a0keep digging.<\/span>\u00a0<\/span><\/p>\n

            <\/span>Raw Data\u00a0Isn’t\u00a0Actionable\u00a0Intelligence<\/span><\/b>\u00a0<\/span><\/span><\/h2>\n

            Intelligence professionals\u00a0know\u00a0that information is not\u00a0intelligence. Raw\u00a0data from signals intelligence\u00a0(SIGINT)\u00a0intercepts or\u00a0open source\u00a0(OSINT)\u00a0data\u00a0becomes\u00a0actionable\u00a0intelligence only after analysis\u00a0and contextualization.\u00a0Many advisers\u00a0treat compliance as a\u00a0collection\u00a0exercise;\u00a0gather enough emails,\u00a0maintain\u00a0enough spreadsheets,\u00a0convene\u00a0enough committees, and somehow compliance\u00a0magically\u00a0results.\u00a0\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

            The\u00a0Tradecraft<\/span><\/b>:\u00a0During your reviews,\u00a0ask yourself\u00a0one of\u00a0the hardest questions\u00a0in intelligence work: “What can I infer from this evidence?”\u00a0Does\u00a0your trade blotter\u00a0demonstrate\u00a0that\u00a0you’re\u00a0getting\u00a0the best\u00a0execution\u00a0or just\u00a0that you\u00a0<\/span>have<\/span><\/i>\u00a0a trade blotter?<\/span>\u00a0<\/span><\/p>\n

            <\/span>Know Your Adversary (Even If They’re Not Really Your Adversary)<\/span><\/b>\u00a0<\/span><\/span><\/h2>\n

            Intelligence professionals conduct assessments to understand\u00a0an adversary\u2019s intentions.\u00a0Investment advisers need to do the same with examination\u00a0priorities,\u00a0though calling\u00a0examiners\u00a0“adversaries” would be inaccurate and unwise.<\/span>\u00a0<\/span><\/p>\n

            The SEC publishes examination priorities annually.\u00a0Imagine if hostile intelligence\u00a0agencies\u00a0published their upcoming collection priorities: “Hint, hint!\u00a0This year,\u00a0we’re\u00a0REALLY\u00a0interested in your\u00a0nuclear research\u00a0and AI\u00a0technology!\u201d\u00a0\u00a0Yet many advisers treat\u00a0these examination priorities\u00a0as\u00a0nothing more than\u00a0content for\u00a0their\u00a0annual compliance meeting\u00a0slide decks.<\/span>\u00a0<\/span><\/p>\n

            The\u00a0Tradecraft<\/span><\/b>: Map your firm’s\u00a0highest risk\u00a0activities against current examination priorities. Where they overlap is where you should\u00a0concentrate on\u00a0your resources.<\/span>\u00a0<\/span><\/p>\n

            <\/span>All-Source Analysis<\/span><\/b>\u00a0<\/span><\/span><\/h2>\n

            Intelligence\u00a0professionals\u00a0learned from 9\/11 that silos create blind spots that can be exploited. The CIA, FBI, and NSA each had puzzle pieces, but nobody assembled the big picture. All-source analysis was not adequately conducted, with tragic results. \u00a0Advisory firms make the same mistake;\u00a0trading, operations, marketing, senior management, and compliance\u00a0operate\u00a0in silos.\u00a0When examiners jump between your\u00a0disclosures,\u00a0trade records,\u00a0policies and procedures,\u00a0and marketing materials,\u00a0they’re\u00a0conducting all-source analysis-\u00a0looking for contradictions\u00a0in your\u00a0program.\u00a0Are\u00a0your disclosures\u00a0and procedures\u00a0consistent and\u00a0accurate?\u00a0Do your\u00a0employees\u00a0tell consistent stories?\u00a0In intelligence work, these contradictions are \u201canomalies.\u201d In an exam,\u00a0they\u2019re\u00a0simply called \u201cdeficiencies\u201d.<\/span>\u00a0<\/span><\/p>\n

            The Tradecraft<\/span><\/b>:\u00a0Conduct your own all-source review. Cross-reference\u00a0your\u00a0disclosures, policies\u00a0and procedures\u00a0against actual practices\u00a0and documentation.\u00a0Break down internal silos.\u00a0Find your own anomalies first.<\/span>\u00a0<\/span><\/p>\n

            <\/span>Red Team Exercises<\/span><\/b>\u00a0<\/span><\/span><\/h2>\n

            Military and intelligence organizations conduct “red team” exercises\u00a0in\u00a0which one\u00a0group tries to defeat another group’s defenses. The point\u00a0isn’t\u00a0to win;\u00a0it’s\u00a0to find vulnerabilities before real adversaries do.<\/span>\u00a0<\/span><\/p>\n

            If you\u00a0don\u2019t\u00a0red-team your own compliance program, you are inviting examiners to do it for you;\u00a0at that point,\u00a0you\u2019re\u00a0not preparing\u00a0\u2014you’re\u00a0defending.<\/span>\u00a0<\/span><\/p>\n

            The\u00a0Tradecraft<\/span><\/b>: If you\u00a0haven’t\u00a0stress-tested your compliance program, you\u00a0haven’t\u00a0truly tested it at all.\u00a0Intelligence agencies do this constantly because they know that untested defenses are theoretical defenses.\u00a0Engage an expert\u00a0consultant\u00a0to\u00a0conduct a mock examination to\u00a0attempt\u00a0to find gaps in your program; if they succeed,\u00a0you’ve\u00a0found your vulnerabilities while the stakes are low.\u00a0<\/span>\u00a0<\/span><\/p>\n

            <\/span>Think Like an Intelligence Professional\u00a0<\/span><\/b>\u00a0<\/span><\/span><\/h2>\n

            There are many parallels between intelligence work and compliance beyond those outlined here, especially when it comes to preparation, judgment, and credibility.<\/span>\u00a0<\/span><\/p>\n

            To build a better compliance program, think like an intelligence professional: more tradecraft and less checkbox thinking. Examiners already approach reviews this way.\u00a0Perhaps it\u2019s\u00a0time you do, too.\u00a0<\/span>\u00a0<\/span><\/p>\n","protected":false},"author":12,"featured_media":12880,"menu_order":0,"template":"","resource_type_tax":[160],"delivery_method_tax":[],"certification_tax":[],"class_list":["post-13701","resource_posts","type-resource_posts","status-publish","has-post-thumbnail","hentry","resource_type_tax-blog-article"],"acf":{"resource_description":"","resource_button":"","resource_date":"","include_bdt_time":false,"resource_location":"","is_press_release":false,"form_headline":"","form_id":"","is_paywall":false,"newsletter_type":"global","resource_feed_group":{"show_section":false,"section_headline":"","more_link":"","use_recent_resources":true,"resources":false},"resource_feed_clone":{"resource_feed_group":{"show_section":false,"section_headline":"","more_link":"","use_recent_resources":true,"resources":false}},"gate_this_content":false,"form_embed":"","introduction":"","full_content_":"","new_blue_header":false,"accordion_group":{"show_section":false,"accordion_style":"image","section_subhead":"","section_headline":"","section_text":"","accordion_1_headline":"","accordion":false,"accordion_2_headline":"","accordion_2":false}},"yoast_head":"\nYour Compliance Program Needs More Tradecraft and Less Checkbox Thinking | Comply<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Your Compliance Program Needs More Tradecraft and Less Checkbox Thinking | Comply\" \/>\n<meta property=\"og:description\" content=\"By: Amber Tatman Sr. Director, Compliance Advisory Services Comply When I tell people I\u00a0studied\u00a0intelligence\u00a0for years before\u00a0becoming a\u00a0compliance\u00a0consultant,\u00a0they\u2019re\u00a0often\u00a0baffled by my\u00a0interest\u00a0in\u00a0these\u00a0seemingly disparate\u00a0areas. Yet,\u00a0after\u00a0years in\u00a0compliance,\u00a0I’ve\u00a0realized that\u00a0the disciplines of\u00a0intelligence\u00a0and compliance\u00a0share\u00a0much of the same\u00a0DNA.\u00a0\u00a0 Need-to-Know and Need-to-Show\u00a0 The intelligence\u00a0profession\u00a0operates\u00a0on “need-to-know” principles: restrict information to those who\u00a0require\u00a0it; in compliance, data protection\u00a0and systems\u00a0entitlements\u00a0should\u00a0follow the same principles. However, compliance also\u00a0operates\u00a0by\u00a0a slightly\u00a0different principle: “need-to-show.” […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/\" \/>\n<meta property=\"og:site_name\" content=\"Comply\" \/>\n<meta property=\"article:modified_time\" content=\"2025-12-23T20:11:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.comply.com\/wp-content\/uploads\/2025\/09\/code-of-ethics.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1254\" \/>\n\t<meta property=\"og:image:height\" content=\"836\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Your Compliance Program Needs More Tradecraft and Less Checkbox Thinking | Comply","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/","og_locale":"en_GB","og_type":"article","og_title":"Your Compliance Program Needs More Tradecraft and Less Checkbox Thinking | Comply","og_description":"By: Amber Tatman Sr. Director, Compliance Advisory Services Comply When I tell people I\u00a0studied\u00a0intelligence\u00a0for years before\u00a0becoming a\u00a0compliance\u00a0consultant,\u00a0they\u2019re\u00a0often\u00a0baffled by my\u00a0interest\u00a0in\u00a0these\u00a0seemingly disparate\u00a0areas. Yet,\u00a0after\u00a0years in\u00a0compliance,\u00a0I’ve\u00a0realized that\u00a0the disciplines of\u00a0intelligence\u00a0and compliance\u00a0share\u00a0much of the same\u00a0DNA.\u00a0\u00a0 Need-to-Know and Need-to-Show\u00a0 The intelligence\u00a0profession\u00a0operates\u00a0on “need-to-know” principles: restrict information to those who\u00a0require\u00a0it; in compliance, data protection\u00a0and systems\u00a0entitlements\u00a0should\u00a0follow the same principles. However, compliance also\u00a0operates\u00a0by\u00a0a slightly\u00a0different principle: “need-to-show.” […]","og_url":"https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/","og_site_name":"Comply","article_modified_time":"2025-12-23T20:11:12+00:00","og_image":[{"width":1254,"height":836,"url":"https:\/\/www.comply.com\/wp-content\/uploads\/2025\/09\/code-of-ethics.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Estimated reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/","url":"https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/","name":"Your Compliance Program Needs More Tradecraft and Less Checkbox Thinking | Comply","isPartOf":{"@id":"https:\/\/www.comply.com\/en-gb\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/#primaryimage"},"image":{"@id":"https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/#primaryimage"},"thumbnailUrl":"https:\/\/www.comply.com\/wp-content\/uploads\/2025\/09\/code-of-ethics.jpg","datePublished":"2025-12-23T20:04:59+00:00","dateModified":"2025-12-23T20:11:12+00:00","breadcrumb":{"@id":"https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/#primaryimage","url":"https:\/\/www.comply.com\/wp-content\/uploads\/2025\/09\/code-of-ethics.jpg","contentUrl":"https:\/\/www.comply.com\/wp-content\/uploads\/2025\/09\/code-of-ethics.jpg","width":1254,"height":836,"caption":"A diverse group of business professionals engaged in a collaborative meeting at a modern office. They are working together, sharing ideas, and using laptops."},{"@type":"BreadcrumbList","@id":"https:\/\/www.comply.com\/en-gb\/resource\/your-compliance-program-needs-more-tradecraft-and-less-checkbox-thinking\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.comply.com\/en-gb\/"},{"@type":"ListItem","position":2,"name":"Your Compliance Program Needs More Tradecraft and Less Checkbox Thinking"}]},{"@type":"WebSite","@id":"https:\/\/www.comply.com\/en-gb\/#website","url":"https:\/\/www.comply.com\/en-gb\/","name":"COMPLY","description":"","publisher":{"@id":"https:\/\/www.comply.com\/en-gb\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.comply.com\/en-gb\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.comply.com\/en-gb\/#organization","name":"COMPLY","url":"https:\/\/www.comply.com\/en-gb\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.comply.com\/en-gb\/#\/schema\/logo\/image\/","url":"https:\/\/www.comply.com\/wp-content\/uploads\/2024\/07\/comply-logo.svg","contentUrl":"https:\/\/www.comply.com\/wp-content\/uploads\/2024\/07\/comply-logo.svg","width":136,"height":24,"caption":"COMPLY"},"image":{"@id":"https:\/\/www.comply.com\/en-gb\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/comply-org\/","https:\/\/www.youtube.com\/@COMPLYwithConfidence"]}]}},"_links":{"self":[{"href":"https:\/\/www.comply.com\/en-gb\/wp-json\/wp\/v2\/resource_posts\/13701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.comply.com\/en-gb\/wp-json\/wp\/v2\/resource_posts"}],"about":[{"href":"https:\/\/www.comply.com\/en-gb\/wp-json\/wp\/v2\/types\/resource_posts"}],"author":[{"embeddable":true,"href":"https:\/\/www.comply.com\/en-gb\/wp-json\/wp\/v2\/users\/12"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.comply.com\/en-gb\/wp-json\/wp\/v2\/media\/12880"}],"wp:attachment":[{"href":"https:\/\/www.comply.com\/en-gb\/wp-json\/wp\/v2\/media?parent=13701"}],"wp:term":[{"taxonomy":"resource_type_tax","embeddable":true,"href":"https:\/\/www.comply.com\/en-gb\/wp-json\/wp\/v2\/resource_type_tax?post=13701"},{"taxonomy":"delivery_method_tax","embeddable":true,"href":"https:\/\/www.comply.com\/en-gb\/wp-json\/wp\/v2\/delivery_method_tax?post=13701"},{"taxonomy":"certification_tax","embeddable":true,"href":"https:\/\/www.comply.com\/en-gb\/wp-json\/wp\/v2\/certification_tax?post=13701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}