The framework
A defensible AI governance framework for SEC-registered investment advisers, defined by the questions an examiner would ask and the evidence a firm must be able to produce.
The IDR (If Done Right) Principles are twelve decision frameworks for governing AI at an SEC-registered investment adviser. They are organized in four categories: Foundation, Intelligence, Operations, and Evolution. Each principle maps to a specific question an examiner could ask and the specific piece of evidence a firm must be able to produce on demand.
Every principle ends with the specific question a regulator could ask your firm tomorrow morning. Whether you can produce a documented answer is the through-line.
A principle that produces no evidence is not yet operational. For each one, a firm should be able to name the owner, the workflow, the evidence, and the next review date.
Some principles rest on binding rule text. Others rest on staff and examination signals. A few close a governance gap by reasoned inference. The book says which is which.
The framework in one page
| Category | IDR Principle | If an examiner asks | Primary artifact |
|---|---|---|---|
| Foundation | 1. Chain of Origin | Can the firm show how an AI-assisted output was created, modified, reviewed, and approved? | Chain-of-origin record |
| Foundation | 2. Document the Process | Does the firm have a written AI governance process that existed before the exam request? | AI governance policy / AI Use Policy |
| Foundation | 3. Build for the Show Me Moment | Can the firm demonstrate the process with records, not memory? | Examination-ready evidence file |
| Intelligence | 4. Match the Sophistication | Is the review process sophisticated enough for the content, volume, and format AI now produces? | Content-type-specific screening methodology |
| Intelligence | 5. Decompose Before You Evaluate | Does the firm evaluate components and interactions, not just the document as a whole? | Component-level review record |
| Intelligence | 6. Anticipate Interpretation | Does the process incorporate evolving regulatory guidance and examination signals? | Regulatory intelligence log / update memo |
| Intelligence | 7. Account for Language Evolution | Does the process evaluate slang, emoji, hashtags, informal disclaimers, and platform-native meaning? | Language-evolution review criteria |
| Operations | 8. Explain Decisions | Can the firm explain why each approval was granted? | Approval rationale / decision record |
| Operations | 9. Separate Functions | Are creation, screening, and approval separated sufficiently to preserve independent judgment? | Role map / workflow separation record |
| Operations | 10. Version Everything | Can the firm reconstruct the exact content, process, criteria, and tool version used at the time? | Version history / change log |
| Evolution | 11. Stress-Test | Has the firm tested the process against scenarios it was not designed for? | Stress-test memo / remediation log |
| Evolution | 12. Evolve the Framework | Does the firm periodically review and update the framework itself? | Framework review memo / annual or quarterly review record |
The practical test: for each principle, identify the owner, the workflow, the evidence, and the next review date. If a principle produces no artifact, it is not yet operational.
The structural baseline: a documented chain of origin, written governance that exists before the exam letter arrives, and every workflow built for the show me moment. Three prerequisites. Skip one and the others collapse.
Can the firm show how an AI-assisted output was created, modified, reviewed, and approved?
Does the firm have a written AI governance process that existed before the exam request?
Can the firm demonstrate the process with records, not memory?
Where most firms discover how far they are from defensibility. Screening that matches the sophistication of the content, component-level decomposition, forward-looking regulatory intelligence, and language-evolution awareness. This is the sophistication problem.
Is the review process sophisticated enough for the content, volume, and format AI now produces?
Does the firm evaluate components and interactions, not just the document as a whole?
Does the process incorporate evolving regulatory guidance and examination signals?
Does the process evaluate slang, emoji, hashtags, informal disclaimers, and platform-native meaning?
Where principles become provable behaviors. Decision explainability for every approval, structural separation of the screening function from the approval function, and version control for everything an examiner might ask to see.
Can the firm explain why each approval was granted?
Are creation, screening, and approval separated sufficiently to preserve independent judgment?
Can the firm reconstruct the exact content, process, criteria, and tool version used at the time?
Everything else decays without these. Stress-testing and review cycles built into the governance architecture itself. A framework that cannot evolve is already decaying.
Has the firm tested the process against scenarios it was not designed for?
Does the firm periodically review and update the framework itself?
Keep reading
In the book, each principle carries its full anatomy: why it matters now, what done right looks like, what done wrong looks like in scenarios specific enough to feel familiar, a concrete example, and the examiner question that tests it.
Be first to read it
If Done Right publishes soon. Leave your email and we will send you one note the day it is available, along with early access to the working audit checklist from the book.
Written for the chief compliance officer having the week the policy manual did not plan for, and the owner who controls the budget, authority, and attention to fix it.