Surprising Things That Go Hack in the Night

/0 Comments/in , /by

Building the Guardrails™ | October 2026

Halloween is my favorite time of year. I enjoy the decorations, the scary movies, and the haunted houses, and, of course, all things compliance.

October is also Cybersecurity Awareness Month, and it highlights a different kind of monster in Compliance. These don’t need costumes, and they aren’t after candy. They want your information, your money, and sometimes your whole business.

Unlike my Halloween decorations, they don’t get packed away on the first of November.

Meet the Monsters

The Vampire: Phishing and Credential Theft

Remember those old vampire movies where the vampire couldn’t enter your home unless you invited him in?

Cybercriminals use much the same trick. They send emails that look like they’re from Microsoft, your bank, a client, or even someone in your office. All they need is for someone to click a link or enter their login credentials. Once that happens, they’ve been invited inside.

Employee training, multi-factor authentication, and verifying unusual requests can help keep the vampires outside.

The Zombie: Malware

We’ve all seen the zombie movies. Someone gets infected, and before long, the infection spreads.

Malicious software works much the same way. An infected computer might keep working normally while it quietly collects information, monitors activity, or communicates with an outside party. Some infections spread to other devices.

Keeping software updated, using endpoint protection, and monitoring systems for unusual activity can help prevent an outbreak.

The Werewolf: Insider Threats

Werewolves look perfectly normal until the full moon comes out. Then someone you thought you knew becomes something entirely different.

Insider threats can be just as hard to recognize. An employee may have legitimate access to sensitive information and systems. But what happens when that employee becomes disgruntled, decides to take confidential information, or makes a mistake that exposes the business? Sometimes the employee isn’t even aware there’s a problem. Their account may have been compromised by someone outside the firm.

Not every insider threat is intentional, but the damage can be just as serious. Limiting access to what employees actually need, monitoring unusual activity, and promptly removing access when someone leaves can help reduce the risk.

The Possessed Computer: Ransomware

In the movies, possession turns something familiar into something frightening. What was once under control suddenly isn’t.

Ransomware can do the same thing to your business. One minute, employees are working, files are accessible, and everything seems normal. The next, systems are locked, files are encrypted, and someone is demanding money to give you back control. Paying the ransom doesn’t guarantee you’ll get your information back. Backups are important, but having them isn’t enough. You need to know they work and that you can restore your systems when you need them.

When was the last time someone actually tested your firm’s ability to restore its information?

The Shape-Shifter: Social Engineering and AI Impersonation

This monster can look like your boss, sound like your client, or send an email that appears to come from your IT provider. Artificial intelligence has made impersonation easier and more convincing. The days when poor grammar and misspelled words were reliable warning signs are largely behind us. Imagine receiving a call that sounds exactly like a client asking you to change banking instructions. Would your employees know what to do?

Verification procedures, particularly for money movements and changes to sensitive information, can help prevent a very expensive mistake.

The Invisible Man: Unauthorized Access

Not every intruder announces their arrival. Someone who obtains legitimate login credentials may be able to access your systems without immediately attracting attention. They might spend days or weeks looking around, collecting information, and figuring out what else they can reach.

That’s why access controls, multi-factor authentication, security monitoring, and periodic access reviews matter.  Also, does anyone know whether former employees still have access to any of your systems? It’s worth checking this week.

Frankenstein’s Monster: Third-Party and Vendor Risk

Most businesses rely on a collection of technology providers to keep things running.  There’s the IT company, cloud provider, customer relationship management system, document storage provider, and any number of other applications. 

Each may be doing exactly what it’s supposed to do. But who’s looking at how all those pieces fit together?  Who determines which employees have access? Who reviews security alerts? Who makes sure the responsibilities of one provider don’t end where another provider’s begin?

Outsourcing technology makes sense. Assuming someone else has taken responsibility for everything doesn’t.

The Scariest Monster of All

Many business owners are good with technology.  They install software, set up email, and fix problems when they come up.  It’s natural to think that same skill covers security. It doesn’t, quite.  Keeping your computers running and keeping your business secure are two different jobs.

Someone has to be watching for suspicious activity. Someone has to manage security updates, review access permissions, test backups, and make sure the business can recover from an attack. And someone has to keep up with threats that seem to change almost daily.

None of this means every business needs a full-time IT department. The point is that knowing how to use technology and knowing how to secure it are different skills.  A qualified IT professional or managed service provider brings expertise that most owners don’t have in-house. Even then, the owner should understand what’s being done and whether it’s working.

The biggest risk isn’t always the monster trying to get in. Sometimes it’s assuming you already have everything covered.

Building the Guardrails™

We often talk about cybersecurity in terms of three basic functions: prevention, detection, and response.

Prevention is what you do to keep the monsters out. Detection is how you know when one gets inside. Response is what you do once you discover it.

But how do you know whether your business is prepared?

That’s where the four pillars of Building the Guardrails™ come into play:

  • Clarity: Who is responsible for each security task?
  • Accountability: What exactly are they doing?
  • Documentation: How do we know it’s getting done?
  • Continuous Improvement: When did we last test whether it works?

I’m not suggesting that business owners become cybersecurity experts or that every possible threat can be eliminated. I’m suggesting something much more practical. 

Find one gap. If you can’t answer one of those questions, you’ve found a place to start.  Then find the next one.

The monsters aren’t going away when Halloween is over.

Stile Compliance Services | Building the Guardrails™

#CybersecurityAwarenessMonth #Cybersecurity #InvestmentAdvisers #BuildingTheGuardrails

Building the Guardrails business continuity graphic showing an alternate route around a failed bridge

Building the Guardrails™: When Business as Usual Isn’t an Option

/in /by

Most financial firms have a business continuity plan, and many review or test them annually. But having a plan and being prepared are not the same thing. A business continuity plan can satisfy a policy requirement while still failing when it is needed. The difference usually comes down to whether the plan reflects the way the business operates today—not the way it operated when the document was first written. That distinction matters because financial services firms have become increasingly dependent on interconnected technology, third-party service providers, cloud applications, remote employees, electronic communications, and centralized data. A disruption in any one of those areas can quickly become a business continuity event.

The guardrail is not the document. The guardrail is the firm’s ability to continue serving clients, protect information, communicate internally and externally, and restore critical operations when normal business processes are unavailable.

Business Continuity Has Changed

Historically, business continuity planning often focused on physical disasters. What happens if the office floods? What happens if a hurricane or tornado makes the building inaccessible? Where will employees work if the office cannot be used? Those questions still matter. But today, many firms could lose access to their physical office and continue operating with relatively little interruption. Employees may work remotely, records may be stored in the cloud, telephone service may be redirected, and meetings can move online. That flexibility has solved some traditional continuity problems, but it has also created new dependencies. What happens if Microsoft 365 is unavailable? What happens if the firm’s custodian experiences an outage? What happens if a cyberattack disables systems rather than a tornado disabling the office? Modern business continuity planning must account for the fact that firms may be physically distributed but technologically concentrated. Moving operations to the cloud does not eliminate the risk, it changed where the risk resides.

Start With Critical Functions, Not Disasters

One of the most useful ways to evaluate a continuity plan is to stop thinking first about disasters and instead identify the functions the firm cannot afford to lose. For an advisory or broker-dealer organization, those functions may include serving clients, executing transactions, moving money, communicating with clients and vendors, accessing required information, and managing the firm. Once those functions are identified, the next question becomes more useful: What does each function depend on?

A trading process may depend on an employee, a portfolio management platform, internet access, a custodian connection, multifactor authentication, and a functioning communication channel. Client service may depend on a CRM system, email, telephone service, document storage, and access to account information. Compliance supervision may depend on electronic communications systems, transaction reports, exception reports, branch personnel, and third-party surveillance tools.

Mapping those dependencies shows management what actually has to work for the business to function and often reveals vulnerabilities that a traditional BCP document does not. Instead of trying to predict every possible disaster, the firm identifies what must continue regardless of the cause of the disruption.

The Single-Point-of-Failure Test

Every firm should periodically ask whether any critical process depends too heavily on one person, one system, or one vendor. Perhaps only one employee knows how to process a certain type of transaction. Maybe only one person has administrative access to a critical system. Emergency contact information may exist only inside the CRM system. A backup communication method may depend on the same technology environment as the firm’s primary communication channel. Individually, none of these issues sounds especially dramatic during normal operations. During a disruption, each can become a serious problem very quickly. A useful continuity exercise therefore asks: If this person, system, location, or vendor became unavailable today, what would we do next? If the answer depends on someone “figuring it out,” the process probably needs another guardrail. Someone should own the alternative process, understand when it should be activated, and have the authority necessary to act.

Disaster Recovery Is Only Part of Business Continuity

Business continuity and disaster recovery are often discussed together, but they are not the same thing. Disaster recovery generally focuses on restoring systems and data; business continuity focuses on how the organization functions while that recovery is underway. A technology provider may tell the firm that systems can be restored within several hours. That does not answer how employees will communicate during those hours, how the firm will determine whether urgent client transactions are pending, or how management will know which systems are affected. It also does not determine who communicates with clients or who contacts key stakeholders—regulators, custodians, insurers, vendors, or law enforcement—if circumstances require it. Technology recovery is a critical component of continuity planning. It is not the entire plan.

Your Vendors Are Part of Your Continuity Plan

Financial firms increasingly rely on third parties to perform functions that were once handled internally. That means vendor risk and business continuity risk are increasingly connected. A firm may have excellent internal procedures and still experience significant disruption because a key vendor becomes unavailable. For critical providers, firms should understand whether the provider maintains its own business continuity program, whether that program is tested, where the firm’s data is hosted, and how outages are communicated. Just as importantly, the firm needs its own answer to a simple question: what do we do while this vendor is unavailable? Can information be retrieved another way? Does a manual workaround exist? Is another provider available? How long could the business reasonably operate without the service? These questions separate critical vendors from important ones—and separate preparation from hope. Vendor due diligence therefore should not end with cybersecurity. Operational resilience matters too. But documentation from the vendor is only part of the answer. The firm still needs its own plan for what it will do if that recovery does not happen as expected.

The Plan Must Work Without the People Who Wrote It

Another common weakness in continuity planning is institutional knowledge. The people responsible for creating the plan often know exactly what the document means. Other employees may not.

A useful continuity plan should answer practical questions without requiring interpretation. Who declares an emergency? Who contacts employees and manages communication? How do employees access systems remotely? What systems must be restored first? Where are backup records located? Who has decision-making authority if senior management is unavailable? And one of the simplest questions may be among the most important: Where is the plan itself? A continuity plan stored exclusively inside a system that becomes inaccessible during the disruption is not particularly useful. Documentation becomes an operational control when procedures, emergency contact information, system instructions, escalation responsibilities, and backup processes remain accessible even when normal resources are unavailable. The more a continuity plan depends on unwritten knowledge, the less reliable it becomes during an actual disruption.

Test the Plan You Actually Have

Annual testing sometimes becomes a compliance exercise. A meeting is held. The plan is reviewed. Employees confirm that contact information is accurate. A memo documents that the test occurred. That may demonstrate that the firm reviewed its plan, but document review verifies the plan on paper; scenario testing exposes operational assumptions.

A better test introduces a realistic scenario. Imagine it is 8:15 Monday morning. Employees cannot access Microsoft 365. Email, Teams, SharePoint, and OneDrive are unavailable. The provider estimates that service may not be restored for six hours. Now the exercise becomes practical. How do employees communicate? How does management distribute instructions? Can client information still be accessed? Can trading occur? Can cash requests be processed? Can employees retrieve the firm’s continuity procedures?

Then change one assumption. What happens if the outage lasts two days instead of six hours? The scenario does not need to be elaborate. It simply needs to force the firm to operate without something it normally assumes will always be available. The objective is to discover where the plan breaks while there is still time to fix it.

A Practical Preparedness Test

National Preparedness Month is a good reason to conduct a simple review of the firm’s critical operations. Choose one important business function and begin by asking what it depends on. Identify the people, systems, vendors, information, facilities, and communication channels necessary to perform it. Then remove one of those dependencies. What happens if it is suddenly unavailable? Is there an alternative, or does the process simply stop?

Next, consider who knows what to do and whether the necessary information to execute the backup process is accessible during the type of disruption being tested. If only one employee understands the workaround, the firm may have replaced a technology dependency with a personnel dependency.

Finally, ask whether anyone has tested the workaround. A backup process that has never been used is still a theory.

Repeat that exercise across the firm’s most important functions and a clearer picture begins to emerge. The firm can see where it has clarity, where accountability is missing, and where testing should drive continuous improvement. That tells management far more about preparedness than simply rereading the BCP from beginning to end.

Preparedness Is a Management Discipline

Business continuity planning should not belong exclusively to compliance or IT. Operations understands workflows. Technology understands systems and infrastructure. Management understands business priorities. Employees understand what actually happens during the workday. Effective continuity planning requires all of those perspectives. It also requires ongoing change management. When the firm adopts a new system, changes a vendor, moves records, restructures responsibilities, adds an office, modifies remote-work arrangements, or changes how clients communicate with the firm, someone should ask: Does this change affect our continuity plan? If the answer is yes, continuity planning should be part of implementation, not something compliance discovers during the next scheduled review. The business changes, dependencies change, the plan changes, and testing confirms whether the revised process works.

Build the Guardrails Before You Need Them

Most disruptions do not announce themselves in advance. A storm does not ask whether the firm’s emergency contacts are current. A cyberattack does not wait until the next annual BCP review. Preparedness means making those decisions before the disruption occurs. For financial services firms, that means reflecting actual operations, identifying critical dependencies, assigning responsibility for response, keeping procedures accessible, and testing whether the backup plan works.

A business continuity plan should not simply describe what the firm hopes to do during an emergency. It should provide a workable path for what happens next when business as usual is no longer an option. That kind of preparedness does more than help a firm survive a disruption. It allows leadership, employees, clients, and other stakeholders to have confidence that the organization can continue functioning when conditions become difficult. And that is what well-designed guardrails are ultimately intended to support: sustainable growth and organizational confidence.

Building the Guardrails™: GLBA: Protecting the Trust Your Clients Place in You

/in /by

How GLBA helps firms protect client information—and build stronger, more resilient organizations.

Your firm holds sensitive information. Account statements. Tax documents. Social Security numbers. Beneficiary designations. The personal financial stories of your clients, trusted to your care. As your firm grows, you hold more of it—and the responsibility to protect it grows with you.

The Gramm-Leach-Bliley Act, passed in 1999, is the foundational law governing how you collect, use, protect, and disclose this information. For decades, it has been a steady compliance obligation. But the regulatory framework has tightened significantly in recent years. For SEC-registered advisers, GLBA requirements are implemented through Regulation S-P. For firms subject to the FTC Safeguards Rule, or for state-registered advisers operating under applicable state requirements, the specifics vary—but the core obligation is the same: establish and maintain an information-security program reasonably designed to protect the confidentiality, integrity, and availability of customer information.

This is practical, not theoretical. It means knowing what data you hold. It means limiting access to only those who need it. It means protecting it against theft, misuse, and loss. It means being ready to detect when something goes wrong, respond quickly, and notify clients if their information is compromised.

For too many firms, GLBA sits on the shelf as a compliance obligation; a policy checklist, a training requirement, something the CCO manages and the rest of the firm ignores. That approach no longer works, if it ever did. A data breach is not a compliance problem you solve with a fine. It is a business crisis. It damages client relationships, invites regulatory scrutiny, and can threaten your firm’s viability. Regulators expect you to treat data protection as an operational priority, not a compliance burden.

The Four Guardrails of Client Data Protection

Building a robust data-protection program means thinking through four practical, overlapping responsibilities.

Know the information you hold. Start simple: inventory your data. Where does client information live? What systems does it move through? Who has access? You need documentation, the data map that answers these questions clearly. This is not about perfect completeness; it is about knowing where your risks are. Classify your data by sensitivity: account statements are sensitive; general blog content is not. This clarity informs everything else.

Protect it based on risk. Not all data requires the same level of protection. Your information security program should be proportional to the sensitivity of what you hold and the threats you face. Encryption, access controls, and multi-factor authentication are important tools—but which ones you need depend on your specific systems and risk profile. A firm that stores account statements on a cloud platform faces different risks than one using a legacy on-premise system. Your program should reflect your reality, not a generic checklist. This is where working with IT professionals, whether in-house or through a managed service provider, becomes essential.

Control your service providers. If you use a cloud vendor, a payroll processor, a marketing automation tool, or any third party that handles customer information, they become part of your data-protection program. Your service-provider agreements must impose obligations to protect customer information and to notify you promptly if they become aware of a breach. You also need reasonable assurance that they are meeting these obligations. Audit reports, security certifications, and direct communication matter.

A vendor’s data breach is your data breach in the eyes of your clients and regulators.

Prepare to respond and notify. A robust program does not assume breaches will not happen. It assumes they might, and it prepares accordingly. You need a written incident-response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. This means you know who to contact first (your IT team, your vendors, your counsel). You understand how to assess what happened and how many people were affected. You have procedures for containing the incident and preventing further damage. And you have a process for notifying affected customers when required by law. For many firms, this is the weakest link. When a breach is discovered, panic and improvisation take over. A written plan, tested and understood by key staff, prevents that.

The CCO’s Role—Oversight, Not Omniscience

Data protection is a shared responsibility involving senior management, compliance, IT, operations, vendors, and outside specialists. The firm is responsible. Your role as CCO is to oversee the compliance framework and verify that the program works.

Assign ownership. Make it clear who owns each element of the program—who reports on access controls, who manages vendors, who leads incident response. Distributed responsibility is not diffused responsibility.

Ask informed questions. You do not need to be a cybersecurity expert to do this job well. You need to know what a reasonable program looks like and ask whether your firm has it. Your IT leader or managed service provider should be able to explain your encryption approach, your access controls, and how your systems are monitored. If they cannot, that is the problem to fix, not the conversation to avoid.

Obtain evidence. Your vendors should provide evidence that they meet their contractual obligations. Your incident-response plan should be documented. Your data-handling procedures should be written. Policies sitting in people’s heads are not guardrails. They are hopes.

Confirm the program is tested. The best plan is worthless if no one has ever executed it. When has your incident-response team conducted a tabletop exercise? When did you last review access controls to confirm people still have only the access they need? Testing is not optional. It is the difference between a program and a document.

Escalate unresolved concerns. If your IT team says a control cannot be implemented, or your vendor says they cannot commit to 72-hour breach notification, or your operations team says training is too much overhead—those are not reasons to accept the gaps. Those are reasons for an escalation. Your job is not to solve them. Your job is to make sure someone does.

Turning Policy Into Practice

A written policy is the starting point, not the finish line. The real guardrail is what your firm does every day to keep your program operational and current.

Conduct periodic risk assessments. At least annually, step back and ask: What information do we hold now? What systems does it move through? What are the threats? Have we added vendors, changed platforms, or hired new staff? Have regulations changed? A risk assessment is not a document you file and forget. It is a conversation that informs what you do next.

Review access controls. Who has access to what information? Does a junior advisor still need administrative access to email after they left your firm? Did you ever revoke a former vendor’s login credentials? Access creep is invisible until it is the subject of an audit. Document who has access, review it at least annually, and correct the gaps.

Train your team. New employees need to understand where the lines are. Existing staff need refreshers when policies change or when new tools come online. Training is not a checkbox. It is the mechanism that turns policy into behavior.

Test your incident-response plan. Conduct a tabletop exercise at least once per year. Walk through a scenario: a ransomware attack, a phishing breach, a vendor compromise. Who do you call first? What information do you need? How long does assessment take? Testing reveals gaps in knowledge and responsibility. A tested plan is a plan people understand.

Review vendor contracts and due diligence. When you onboard a new vendor, conduct due diligence and document it. When you renew a contract, review it. Are the data-protection and breach-notification terms still current? Are audit reports current? A vendor agreement drafted three years ago may not reflect the current regulatory landscape. Refresh it.

Document testing and corrective action. When you conduct a risk assessment and find a gap, document it. When you fix it, document that too. When you test your incident-response plan and discover that no one knows how to contact your outside counsel, document the fix and confirm it is done. Documentation is not busy work. It is evidence that your program operates and improves.

Update procedures when things change. When you hire new staff, change vendors, adopt new systems, or discover new risks, update your procedures. Every growing firm reaches a point where memory and informal practices are no longer reliable. Documentation becomes the guardrail that keeps responsibilities clear and processes consistent as the organization changes.

Where Most Firms Stand Now

Compliance with GLBA requirements is now, not future. Some firms have completed their work, they have documented their incident-response programs, reviewed and updated service-provider agreements, and conducted meaningful risk assessments. Others are mid-implementation, working through vendor contracts or finalizing policies. And some are still in the initial stages, having recognized recently that they need to build or strengthen their program.

Wherever your firm is in that spectrum, the priority is the same: completion. If your incident-response plan is still in draft, finalize it and train your team. If your service-provider agreements have not been reviewed for current breach-notification requirements, schedule that work now. If you have not documented your current risk assessment or the controls that address those risks, that is the logical starting point. Regulators are already examining how firms are implementing GLBA. The firms that move deliberately and methodically, establishing clear ownership and realistic timelines, will have less work to do in an audit than those that leave gaps.

More broadly, this is a reminder that the regulatory landscape will keep shifting. New technologies will emerge. New risks will appear. The firms that have built guardrails, not as a one-time compliance exercise, but as an ongoing discipline, will adapt more quickly and more confidently. A firm with clear governance, documented procedures, distributed ownership, and a habit of regular review can absorb regulatory change without panic. That is what separates the firms that treat compliance as a burden from the firms that treat it as a foundation.

Governance is not measured by the policies sitting in a binder. It is measured by how your firm protects client information every day.

Clients may never see your incident-response plan. They may never ask about your vendor due diligence or access controls. They simply trust that you have done the work.

Protecting that trust is not only a compliance obligation. It is one of the guardrails that allows a firm to grow with confidence.

That is what Building the Guardrails™ is about.

This article is part of our ongoing Building the Guardrails™ series, where we explore the governance principles that help financial firms build stronger, more resilient organizations.

Continue the Building the Guardrails™ Series

Part 1: What Is Governance, and Why Should I Care?

Part 2: AI Governance for Modern Firms

Part 3: Protecting Client Information (Current Article)

Building the Guardrails™: AI Governance for Modern Firms

/in /by

The duty is old. The diligence is new.

Somewhere in your firm right now, someone is using artificial intelligence. Maybe it’s an advisor drafting a client email. Maybe it’s a vendor quietly embedding AI into a tool you’ve relied on for years. Maybe it’s you, testing whether it can summarize a hundred pages of due diligence faster than you can. And somewhere in the back of your mind, a question is forming: are we supposed to have a policy for this?

If you’ve read anything about AI governance lately, you’ve probably come away with the impression that the answer requires an entirely new discipline — new committees, new frameworks, new certifications, new consultants speaking a new language. The message, intended or not, is that everything you’ve built is suddenly insufficient, and that the rules of running a responsible firm have been rewritten overnight.

We’d like to offer a different starting point: there is nothing new under the sun when it comes to fiduciary obligation and sound governance.

Your Obligations Didn’t Change. Your Tools Did.

Fiduciary duty — and the regulatory framework built around it — has always been technology-neutral. The duty of care didn’t bend when firms adopted email. It didn’t bend for cloud storage, for portfolio management software, for algorithmic trading tools, or for the dozens of other technologies that once felt disruptive and now feel like furniture. Each time, the obligation stayed exactly where it had always been: understand the tools you use, supervise how they’re used, protect the people who trust you, and be able to demonstrate that you did.

AI is the newest chapter in that same story. When an advisor uses an AI tool to draft client communications, the firm’s obligation to supervise those communications is the same obligation it has always had. When a vendor embeds AI into its platform, the firm’s duty to understand and oversee that vendor is the duty it owed before the word “algorithm” ever appeared in a pitch deck. A firm with genuine governance — clear roles, real accountability, honest documentation, and a habit of continuous improvement — doesn’t need a new rulebook for AI. It needs to apply the rulebook it already has.

That should be reassuring, and it’s meant to be. Governance that only works for the technologies you already understand was never really governance. It was familiarity.

So Why Does It Feel So Different?

Because the terrain is genuinely new, even if the principles aren’t. This is where the honest version of “nothing new under the sun” has to be careful not to slide into “nothing to do.”

AI introduces failure modes that your existing processes were never asked to catch. It can produce confident, fluent, and entirely wrong answers — and do so in your firm’s voice. It can operate inside vendor platforms as a black box, making it hard to explain how a recommendation was reached. It can quietly carry client information into places it should never go, if the tool’s data practices weren’t examined before someone started pasting. And it operates at a speed and scale that makes after-the-fact review, the traditional safety net, feel like watching a highway through a keyhole.

None of this changes what you owe your clients. All of it changes the questions you have to ask to meet that obligation. The duty is old. The diligence is new.

The Same Arc, the Newest Curve

If you’ve followed this series, you know the pattern by heart: growth creates complexity, complexity creates risk, and intentional guardrails create confidence. AI may be the purest expression of that arc we’ve ever seen.

The growth is real — firms are adopting AI because it works, because clients expect responsiveness, and because the efficiency gains are too significant to ignore. That growth immediately creates complexity: more tools, more vendors, more places where judgment is being exercised by something other than a person you hired and trained. And that complexity creates risk — not because AI is malicious, but because unexamined complexity always does.

The answer is the same one it has always been. Not prohibition, and not paralysis. Guardrails.

What AI Guardrails Actually Look Like

Good AI governance is built from the same four materials as every other kind of good governance, applied to the newest curve in the road.

It starts with clarity. Your people should know, without guessing, which AI tools are approved, what they may be used for, and what must never go into them. Most AI incidents at advisory firms won’t come from bad actors. They’ll come from good people who were never told where the lines were.

It requires accountability. Someone at your firm should own AI oversight by name — not a committee that meets quarterly and owns nothing, but a person who evaluates new tools, reviews how existing ones are behaving, and answers when a regulator or a client asks how you supervise this. If AI is everyone’s responsibility, it is no one’s. Shared governance can work — but only when someone is clearly at the wheel.

It depends on documentation. When you adopt an AI tool, write down what you considered, what you asked the vendor, and why you said yes. When you decline one, write that down too. The firms that navigate regulatory scrutiny well are never the ones with perfect judgment. They’re the ones who can show their judgment was exercised.

And it lives through continuous improvement. AI tools change faster than almost any technology your policies have ever governed. A policy written this quarter and reviewed “when we get to it” may soon describe tools, features, and risks that have already changed.

Notice what’s absent from that list: nothing requires you to become a technologist. Guardrails don’t drive the vehicle, and they don’t need to understand the engine. They keep the organization safely on the road as the road gets faster.

The Firms That Get This Right

A firm that treats AI as exempt from its governance isn’t facing a new kind of failure. It’s failing at the oldest obligation in the book — the duty to supervise what happens under its roof. And a firm that treats AI as so novel that it freezes, waiting for perfect regulatory clarity before engaging at all, is making a quieter version of the same mistake: allowing circumstance to decide instead of the firm.

The firms that will look wise five years from now are the ones treating AI the way sound firms have treated every powerful new tool — with curiosity, with structure, and with the confidence that comes from knowing their governance was built to handle what they hadn’t seen yet. That is what guardrails are for. Not the road you know. The road ahead.

There is nothing new under the sun. There is only the next stretch of highway — and the question of whether you built your guardrails before you got there. That, in the end, is what this entire series is about: sustainable growth and organizational confidence.

Stay tuned. Follow Stile Compliance Services on LinkedIn to see where the series goes next.

Building the Guardrails™

/in /by

A Framework for Better Organizational Decision-Making

Governance isn’t about adding layers of process. It’s about creating clarity, accountability, and smarter decisions — every day.

Success has a funny way of changing a business.

In the beginning, everything feels simple. The team is small enough that everyone knows who owns each responsibility. Decisions happen quickly because the people making them are often sitting around the same table. If a problem arises, everyone instinctively knows who should step in.

Then the business begins to grow.

Growth is exciting. New clients arrive. New employees join the team. Technology opens doors to new opportunities. Services expand, and the organization becomes more capable, more sophisticated, and more valuable than it was just a few years before.

And then, almost without anyone noticing, something else begins to grow alongside the business: complexity. The systems that once worked effortlessly begin to strain under the weight of success. Information flows through more people. Decisions involve more departments. New technologies introduce new opportunities, but also new responsibilities. Processes that once existed only in conversation now need to exist on paper.

One afternoon someone asks a question that should have an obvious answer: “Who’s responsible for this?”

The silence that sometimes follows isn’t a sign that people don’t care. More often, it’s a sign that everyone assumed someone else owned it. That’s how governance problems usually begin — not with bad people, not with poor intentions, but simply with growth.

Growth creates complexity. Complexity creates risk.

The organizations that continue to grow successfully recognize this reality early. Rather than waiting for confusion to expose weaknesses in the way they operate, they begin building something that allows growth to continue with confidence.

They build guardrails.

Seeing Governance Differently

Governance has an image problem.

Mention the word and most people immediately think about policies, committees, approvals, or binders full of procedures that only get opened during an audit. It’s understandable — poor governance often feels exactly like that. Good governance feels completely different.

Good governance creates clarity.

It answers questions before they become problems. It establishes accountability before responsibilities become blurred. It gives people confidence to make decisions because they understand both the boundaries within which they can operate and the authority they’ve been entrusted with.

The best governance frameworks rarely draw attention to themselves. They’re simply part of the way an organization operates. Like good architecture, they’re noticed most when they’re missing.

Building the Guardrails

When we work with clients, we often compare governance to the guardrails on a winding mountain road. The guardrails don’t decide where you’re going, don’t drive the vehicle, don’t choose the destination, and don’t even determine how quickly you travel. Their purpose is much simpler: they help keep the journey from ending because of one avoidable mistake.

Organizations aren’t much different. The business determines where it wants to go. Leadership sets the direction. Employees move the organization forward every day through thousands of individual decisions. Governance builds the framework that helps keep all those decisions aligned as the organization grows.

That’s why we chose the name Building the Guardrails™ — not because governance should restrict growth, but because growth deserves a framework strong enough to support it.

How Do You Create Good Guardrails?

It starts with clarity — defining who decides what, what matters in that decision, and how it gets made, so no one on the team is left guessing where the boundaries are.

Then comes accountability. Every major decision needs an owner: someone whose name is attached to the outcome, not just the intention behind it.

Next is documentation. It captures the reasoning so it doesn’t leave when the person does — so the next hire, and the next version of the organization, understand not just what was decided, but why.

And it ends with continuous improvement: checking what worked, adjusting what didn’t, so the firm gets better instead of repeating itself.

Clarity. Accountability. Documentation. Continuous improvement. That’s how a plan for governance becomes a guardrail an organization can actually lean on.

The Difference Between Growing and Scaling

Every organization grows, but not every organization scales well. Growth adds people, while scaling adds clarity. Growth introduces new technology, while scaling defines how that technology should be used. Growth creates more decisions, while scaling establishes who should make them.

That’s where governance quietly becomes one of the most important enablers of sustainable growth and organizational confidence. Not because it helps avoid regulators, but because it helps the business continue growing without losing control of the things that made it successful in the first place.

The strongest organizations aren’t necessarily the ones with the thickest policy manuals. They’re the ones where expectations are understood before questions become problems.

Where Compliance Fits

One of the biggest misconceptions about compliance is that its purpose is to slow the business down. We’ve never believed that’s true.

Compliance’s job isn’t to override the business’s decisions. It’s to make sure those decisions hold up — that the business can innovate, serve clients, and grow without the guardrails failing under the weight of that growth.

That distinction changes the conversation entirely. Instead of asking, “What rules do we have to follow?” organizations begin asking, “What framework do we need to support where we’re going?” That’s a governance conversation — and it’s a far more valuable one.

Governance Is Never Finished

No organization reaches a point where governance is complete. Businesses evolve. Markets change. Technology advances. Client expectations continue to rise. Every stage of growth introduces new complexity, and every new layer of complexity deserves thoughtful guardrails.

The healthiest organizations periodically step back and ask themselves a simple question: “Do the guardrails we’ve built still support the business we’re becoming?”

Sometimes the answer is yes. Sometimes the answer reveals an opportunity to strengthen the framework before the business outgrows it. Either answer is a sign that governance is doing exactly what it’s supposed to do.

Build the Guardrails Before You Need Them

At Stile Compliance Services, we believe governance should never be viewed as bureaucracy. It should be viewed as confidence — confidence that enables sustainable growth and organizational confidence, confidence to innovate, confidence to grow, and confidence to embrace new opportunities without losing sight of the responsibilities that accompany them.

Because growth will always create complexity, and complexity will always introduce risk. But organizations that intentionally build the right guardrails position themselves to continue growing with confidence.

After all, innovation moves fast. Guardrails help keep us on the road.

Coming Next in the Building the Guardrails™ Series

This article introduces the philosophy behind Building the Guardrails™. In the months ahead, we’ll apply this framework to many of the governance challenges confronting modern financial services firms, including artificial intelligence, cybersecurity, electronic communications, vendor oversight, marketing compliance, and annual compliance reviews.

Each topic presents different questions. Each introduces different risks. But each begins with the same realization: growth creates complexity, complexity creates risk, and intentional guardrails create confidence.

We’ll begin with one of the most transformative — and misunderstood — developments facing organizations today:

Building the Guardrails™: AI Governance for Modern Firms

Stay tuned. Follow Stile Compliance Services on LinkedIn to be the first to know when it publishes.