For regulators and supervisors
Built for the firm.Built to make your job easier.
If Done Right was written for the people a regulator examines: the chief compliance officer and the firm owner. It was built so that the person doing the examining could use it too.
If Done Right is written for compliance officers and firm owners, and built so a regulator can use it too. The twelve IDR Principles turn examiner questions into a defensible standard: for each one, the question to ask a firm and the evidence it should be able to produce. Every principle also carries a framework-agnostic lens, so supervisors beyond the SEC can adapt it to their own regime.
Not adversaries
The examiner and the firm face the same problem, from opposite chairs.
The book opens on a Wednesday night at the desk of an examiner it calls John. He covers dozens of firms with a playbook written before the technology existed, and carries the private worry of not knowing what he does not know. He is not an adversary. He is a colleague who has been handed an impossible job. Every principle in the book was written with his side of the desk in mind, because a market of high integrity is the outcome the firm, the regulator, and the client all want.
The authors are two CFA charterholders and practicing professionals, not commentators. The CFA Institute built its standard on ethics and integrity, and that is the posture the book brings to regulators: partnership. We all want the same thing, a market of high integrity that serves clients, firms, and the country that depends on them.
What it offers your team
Evaluation structures you could adopt tomorrow morning
A translation layer
Appendix B maps SEC examiner questions to the twelve principles and back to the specific regulations behind them. Each principle is a question a firm can be asked tomorrow morning, paired with the artifact it should be able to produce.
A ready question set
In the authors’ framing, examination staff will find useful evaluation structures and specific questions, organized in a framework they could adopt immediately. The working audit checklist in Appendix C doubles as a preparation tool.
The view from inside the firm
The book was written from inside a practicing SEC-registered adviser and tested in production before it was written down. It is the in-the-trenches perspective a supervisor rarely gets: how AI actually enters a firm, and where governance actually breaks.
A standard that survives the tools
The book calls its durable layer gensoku: the principle that outlives the technique. It is why a framework built on today’s tools can still guide oversight of tools that do not exist yet.
Beyond the United States
The rules are American. The mechanism is universal.
If Done Right is anchored in United States securities law, because a principle can only be stress-tested against a real regulatory surface. But the mechanism beneath it is not American. Map where AI has entered the firm. Require documented evidence, not memory. Ask the one question that tests each control. Every principle in the book carries a framework-agnostic lens showing how it applies beyond the SEC, which makes the twelve a portable reference model for any supervisor drafting or revising AI policy.
For a regulator forging new rules in a field that moves this fast, the book’s closing idea matters most. It calls the durable layer gensoku: the principle that survives after the specific technique changes. Policy anchored in principle can evolve with the technology instead of freezing to the tool that existed the year it was written.
Go deeper, privately
A confidential, two-day regulatory sprint
The book is the public reference. For a regulatory team that wants to move faster, the authors offer a private, off-the-record engagement. The two-day sprint is designed to bring a supervisory or policy group current on how AI is actually deployed inside regulated firms, where governance breaks, and how to read a firm’s AI story with confidence. It is practitioner to supervisor, pro-regulator and pro-compliance, with nothing to sell you but the terrain itself.
What the sprint covers
- The current AI surface inside regulated firms, mapped to priorities you already examine
- Where governance actually breaks, drawn from real failures the authors encountered and corrected
- Evaluation structures and question sets your team can adapt to its own regime
- An open, confidential room: no recordings, no vendors, no product pitch
Or write to stefan@chaos.holdings.
The sprint is offered through Chaos Holdings, LLC, the authors’ AI advisory practice, and is separate from any registered firm. The IDR Principles are a reference model, not model rule text, and nothing on this page implies that any regulator has adopted, endorsed, or engaged the authors.
Is this you
Who this page is for
- SEC examination and policy staff evaluating AI use at registered advisers
- Securities and financial-conduct regulators outside the United States building an AI supervisory approach
- Self-regulatory organizations and standard-setters drafting AI guidance
- Policy teams revising existing rules as AI capabilities move
Frequently asked questions
Is If Done Right written for regulators?
Can a regulator outside the United States use the IDR framework?
What is the two-day regulatory sprint?
Are the authors trying to influence rulemaking?
Be first to read it
The window is open now.Be ready before it closes.
If Done Right publishes soon. Leave your email and we will send you one note the day it is available, along with early access to the working audit checklist from the book.
Written for the chief compliance officer having the week the policy manual did not plan for, and the owner who controls the budget, authority, and attention to fix it.