The challenge, however, is what can be termed the "roadmap theory." That is, that the entire process of conducting a mock exam – especially the final written deficiency report – will effectively act as an evidentiary roadmap for the SEC or state regulator when an actual examination of the adviser's business is initiated. Why flood the cemetery and raise all the skeletons from their 6-foot-deep closets?
It's a perfectly legitimate concern, especially given the "broken windows" tenor of today's regulators. Yet it's also a concern that may at least be partially mitigated by protecting the entire mock examination process by attorney-client privilege. The idea is that – if executed properly – an adviser would not have to respond to questioning or produce documents to a regulator related to a mock examination, including any deficiency reports, under the theory that all such information is protected from disclosure by attorney-client privilege. So how is this done?
First, let's dispel a few common myths:
- Simply cc-ing an attorney on emails between the adviser and the independent compliance consulting firm is ineffective for purposes of asserting privilege. That would be too easy.
- The fact that a compliance consulting firm is owned or staffed by attorneys does automatically mean that the adviser and the compliance consulting firm are in an attorney-client relationship. Read the engagement letter or contract with the compliance consulting firm carefully: does it affirmatively establish an attorney-client relationship and call for the rendering of legal advice, or does it call for mere compliance consulting? A common arrangement is for a compliance consulting firm to be affiliated with a law firm or individual attorney, in which case the engagement should be with the affiliated law firm or attorney if there is any interest in claiming privilege over the process or its deliverables.
- Attorneys do more than provide legal advice 24/7 (though their bills may suggest otherwise). They routinely provide non-legal advice in areas of risk, compliance, business judgment, strategy, etc. Privilege can only apply in conjunction with attorneys providing legal advice. This is also true for in-house counsel that are also the CCO; by definition a dual-hatted attorney must spend at least some time not rendering legal advice to her client (the advisory firm).
The ability to assert privilege is highly fact-specific, but I've attempted to summarize a few possible scenarios below in which privilege may or may not be available. For purposes of the table below, I have assumed that the compliance consulting firm and law firm are separate legal entities, even though they may be affiliated and run by the same person(s).
| Fact Pattern | Privilege? |
| Non-attorney CCO retains a compliance consulting firm directly to conduct a mock exam | No |
| Non-attorney CCO or her staff conduct a mock exam internally without engaging a compliance consulting firm or law firm | No |
| In-house counsel (non-CCO) retains a compliance consulting firm directly to conduct a mock exam | Maybe* * Assuming the in-house counsel uses the information and documents to render legal advice to the adviser. |
| CCO who is also in-house counsel retains a compliance consulting firm directly to conduct a mock exam | Maybe* * Same assumption as above, and that the in-house attorney is wearing her attorney hat (not her CCO hat) throughout the process. This may prove difficult. |
| In-house counsel (non-CCO) or her staff conduct a mock exam internally without engaging a compliance consulting firm or law firm | Maybe* * Assuming the in-house counsel undertakes the mock exam for the express purpose of rendering legal advice to the adviser. |
| CCO retains outside counsel who in-turn retains a compliance consulting firm to conduct a mock exam | Yes |
| Non-attorney CCO retains a law firm directly to conduct a mock exam | Yes |
| In-house counsel retains a law firm who in-turn hires another law firm to conduct a mock exam | Overkill. Clearly budget is not a concern. |
This table paints with a broad brush at a high level, and privilege can be fairly easily waived if not vigorously protected. What's more, advisers should carefully consider whether they are even comfortable refusing to answer questions or produce requested documents in the face of an examination by the SEC or a state regulator. Such a posture definitely has the potential to affect the tenor of the exam, and will certainly not engender any cooperation benefit in the case of an enforcement action.
Yet this entire dance may ultimately fade into obscurity within a few years. It's no secret that the SEC will soon propose to mandate some form of third-party adviser examinations, and asserting privilege over that process will not be an option. Query advisers' willingness to continue to pay for voluntary mock examinations if they will be forced to pay a third-party to perform an SEC-required examination anyway. Regardless, privilege is a fundamental tenant of the attorney-client relationship, and should be wielded mindfully by advisers and their attorneys alike.
