Questions and answers
About the book and the framework
The most common questions about If Done Right, the twelve IDR Principles, and what a defensible AI governance process actually requires.
Frequently asked questions
What does IDR stand for?
IDR stands for If Done Right. The premise of the book is that AI, and technology generally, can be a powerful asset for a regulated firm and the marketplace, but only if done right. Done wrong, it is a liability.
How many IDR Principles are there?
Twelve. They are organized in four categories that map to the layers of a defensible AI governance architecture: Foundation (Principles 1 to 3), Intelligence (Principles 4 to 7), Operations (Principles 8 to 10), and Evolution (Principles 11 to 12).
What are the four categories?
Foundation is the structural baseline: chain of origin, a written policy, and examination readiness. Intelligence is where screening must match the sophistication of the content. Operations is where principles become provable behaviors: explainable decisions, separation of functions, and version control. Evolution builds stress-testing and review cycles into the architecture so the framework does not decay.
Are the IDR Principles a compliance checklist?
No. They are decision frameworks. Each one is operationally testable, ends with the specific question an examiner would ask, and identifies the artifact the firm must be able to produce. A principle that produces no artifact is not yet operational.
Do the principles only apply under the SEC Marketing Rule?
No. The Marketing Rule is the lens the book uses for its worked examples, because winning clients and adding AUM is central to firm growth. The principles are regulatory agnostic by design and apply wherever AI contributes to a regulated output, including trading, client communications, vendor management, privacy, and custody.
Who should read If Done Right?
The primary reader is the chief compliance officer at an SEC-registered investment adviser. It is also written for firm owners and principals, who control the budget, authority, culture, and attention that AI governance requires. Part V is addressed directly to owners.
Is this book only for large firms?
No. The book includes a Minimum Viable IDR path scaled to firm size and maturity, plus a concrete First 30 Days sequence. Smaller firms get a starting layer that works, and enterprise firms get a fuller infrastructure standard.
Why does the book emphasize acting now?
There is a window. No public enforcement action has yet targeted AI governance at a registered investment adviser, and no binding guidance defines what reasonably designed supervisory procedures look like when AI is involved. Firms that build documented governance during this window will have years of audit trail when standards formalize. The window closes when the first significant AI-governance enforcement action arrives.
Who wrote the book, and did they build a real system?
Brandon Veldman, CFA, co-founder and CEO of Chaos Holdings, built the AI screening infrastructure. Stefan Whitwell, CFA, CIPM, runs Whitwell & Co., a practicing SEC-registered advisory firm where every principle was tested. The platform referenced in the book, TIME, is available at timewrit.com so readers can evaluate the operational context.
Is If Done Right legal or investment advice?
No. It is for general informational and educational purposes only. It is not legal, tax, accounting, or investment advice, and reading it does not create an attorney-client, adviser-client, or accountant-client relationship. Consult your own counsel and compliance professionals before acting.
When is the book available, and how do I get notified?
The book publishes soon. Enter your email in the notify section on this site and you will receive one message the day it is available, along with early access to the working audit checklist from the book.
Be first to read it
The window is open now.Be ready before it closes.
If Done Right publishes soon. Leave your email and we will send you one note the day it is available, along with early access to the working audit checklist from the book.
Written for the chief compliance officer having the week the policy manual did not plan for, and the owner who controls the budget, authority, and attention to fix it.