Safety Norms: Corporate Finance and Investment Advisory

1Purpose, Scope, and Safety Principles

These norms protect people, money, information, and the integrity of corporate finance and investment advisory work. In this subject, harm is usually financial, legal, or reputational rather than physical. The consequences can still be severe: misdirected payments, misstated valuations, leaked deal information, and advice given without a proper basis can damage clients, employers, and individuals. The scope covers classroom case work, simulated transactions, spreadsheet models, research notes, and any real or simulated client engagement, including the tools and records used to produce them.

Four principles apply throughout. First, no single person should both initiate and approve a financial action. Second, every number or recommendation must be traceable to a source. Third, confidential information is shared only on a need-to-know basis. Fourth, doubt is escalated rather than resolved privately. A valuation is an estimate of what an asset or business is worth. Due diligence is the structured review of a target company's records. A segregation of duties control separates conflicting tasks among different people.

2Roles, Competence, and Accountability

The course instructor or program owner is accountable for setting approved procedures, authorizing the use of simulated or real data, and making sure learners have current instructions. Team leads approve work products within their authority and confirm that reviewers are independent of the preparers. Learners must follow these norms, complete required training, and report concerns. Where the course involves a live organization, the finance controller, compliance officer, and information security lead hold defined authority that course staff cannot override.

Competence and authorization matter. Learners may build models and draft memos, but they may not send recommendations to real clients, sign external documents, release funds, or access live systems unless the sponsoring organization has formally authorized them and they have completed the required training. Whether advice relied on by a third party requires a license, registration, or specific disclosures is jurisdiction-dependent and must be confirmed with the competent authority or qualified counsel.

• Mandatory: No learner releases payments, changes bank details, or signs external documents without written authorization from the named approver.
• Mandatory: Each project team records a named preparer, reviewer, and approver before any output leaves the team.
• Recommended: Hold a short competence check before any learner works on live deal data.

3Activities, Hazards, and Risk Assessment

Typical activities include building discounted cash flow and leveraged buyout models, preparing capital budgeting and capital structure analyses, running comparable company and transaction valuations, drafting pitch materials, reconciling transaction ledgers, processing simulated payment runs, and reviewing target company data rooms. The people involved include students, instructors, client representatives in case scenarios, and, in live settings, bankers, analysts, auditors, and compliance staff. The tools include spreadsheets, financial databases, virtual data rooms, payment and ledger systems, email, and collaboration platforms. Environments range from classrooms to remote settings where files may be opened on home networks or mobile devices.

Risk is rated by likelihood and impact on a three-point scale of low, medium, and high. A formula error in a valuation model is high impact when the output drives a price proposal, and medium likelihood because models are often reviewed too late or not at all. Sharing a data room link with an uninvited party is high impact and medium likelihood. Misfiled client documents are medium impact and high likelihood. Each project team must complete a written risk assessment before starting work and update it at every milestone. The main hazards are these:

• Model error: hardcoded figures, broken links, wrong discount rate or growth assumptions, and unit mismatches. Control: independent model review and a checks tab.
• Payment or instruction fraud: spoofed emails requesting urgent wire transfers or bank detail changes. Control: call-back verification using a number already on file.
• Insider information: material non-public information about a target or client. Control: restricted list and documented approval before any wall crossing.
• Record falsification or incomplete records: backdated documents and unsupported adjustments. Control: version control and an audit trail.
• Conflicts of interest: personal holdings in a target company or a relationship with a counterparty. Control: written disclosure and recusal.
• Data exposure: uploading confidential files to unapproved AI, cloud, or messaging tools. Control: approved tool list only.

4Preventive Controls and Safe Work Practices

Segregation of duties is the central financial control. The person who creates a payment instruction, vendor record, or journal entry must not approve it, and neither of them should reconcile the related bank or ledger account. In small teams where full separation is impossible, the compensating control is independent review by a second person with documented sign-off. The limitation must be recorded in the risk assessment. This principle applies in simulations too, because learners practice habits that carry into employment.

Fraud prevention depends on verification rather than trust. Any request to change payment details, release funds, or share sensitive files must be confirmed through a separate channel, using contact details held in the approved vendor or client master file, not details supplied in the request. Urgency, secrecy, and pressure from a senior name are warning signs, not reasons to skip steps. The finance controller sets dual authorization thresholds. Where no threshold exists, every payment instruction requires two approvers.

Model and valuation safety requires structured review. Each model includes an assumptions sheet, a source reference for every input, a checks tab that flags balance and sign errors, and a version log. Sensitivity tables should be run for key drivers such as discount rate and terminal growth rate, and the output range should be reported rather than a single figure. Recommendations must state their assumptions and limitations in plain language.

Advisory conduct safeguards require conflict checks before work begins, a restricted list for active targets, and a firm rule against trading or advising others on securities based on non-public information. Recommendations to real parties must be reviewed by the compliance function before release. Local rules on securities trading, fairness opinions, and disclosure are jurisdiction-dependent, so confirm them with the competent authority or qualified counsel before relying on them.

• Mandatory: Keep preparer, approver, and payment releaser as three separate people for every financial action.
• Mandatory: Verify any change to bank or payee details by calling a number already on file, never a number supplied in the request.
• Mandatory: Do not use non-public target or client information for personal trading or to advise anyone outside the authorized team.
• Mandatory: Store source data and final versions only in approved locations with access logs enabled.
• Recommended: Recalculate key outputs independently before each milestone review.
• Recommended: Use a standard reconciliation template and resolve differences within a deadline the team agrees in advance.

5Information, Confidentiality, and Protective Safeguards

Confidentiality is the main information safety concern. Deal data, client financial statements, forecasts, and personal data about executives must be classified as public, internal, confidential, or restricted. Restricted material is shared only with named individuals on an access list. Files are watermarked where the platform allows, and downloads from virtual data rooms are limited to approved users. Personal data should be minimized, so unnecessary identifiers are removed before case material is used in shared work.

Security safeguards include multi-factor authentication on email, file, and financial systems, no sharing of credentials, locked screens when unattended, and no working papers on personal USB drives. Public AI tools, personal cloud storage, and consumer messaging apps must not receive confidential or restricted data unless the program has approved them in writing. Printed materials are shredded or placed in secure collection bins. Workstations used for long spreadsheet sessions should follow the organization's ergonomic guidance, including screen height and regular breaks. This is a recommendation, not a substitute for occupational health advice.

• Mandatory: Never paste restricted data into unapproved tools, including AI assistants.
• Mandatory: Report lost devices or suspected credential exposure on the same working day.
• Recommended: Use anonymized or synthetic data for practice models wherever possible.

6Incident Reporting, Escalation, and Response

An incident is any event that could cause financial loss, data exposure, regulatory breach, or misleading advice. Examples include a suspicious payment request, a file sent to the wrong recipient, a model error found after circulation, a bypassed control, or suspicious trading activity observed within a team. Report immediately to the designated contact rather than only to a classmate or colleague. Do not investigate fraud, attempt to recover funds, or contact suspected parties yourself. Preserve evidence by keeping the original email, file, and system log unedited.

Escalation paths are defined in advance. Payment and fraud concerns go to the finance controller and the bank contact through the approved call-back process. Data exposure goes to the information security lead on the same working day, with the compliance officer copied. Possible insider information or market abuse concerns go to compliance at once, and related trading or advice stops until compliance clears it. Threats to personal safety go to building security and local emergency services. Recall of externally sent documents follows the approved recall procedure.

• Immediate: Stop the action, do not release funds, and preserve the record.
• Same working day: Submit a written report on the incident form, including time, people involved, systems affected, and actions taken.
• Near misses are logged and reviewed with the same care as incidents.
• No retaliation is permitted against anyone who reports a concern in good faith.

7Records, Training, Monitoring, and Review

Accurate records are a safety control. Every deliverable keeps a version log, source references, reviewer sign-off, and an audit trail of changes. Corrections are made by adding an attributed revision note, not by overwriting earlier work. Record retention periods and privacy rules are jurisdiction-dependent, so confirm them with the records manager or qualified counsel.

Training must cover these norms before any live data work, with refresher sessions whenever procedures or tools change. Monitoring includes periodic sampling of reconciliations, access logs, model reviews, and incident reports. These norms are reviewed after any incident, after a significant change to tools or course scope, and on the review cycle set by the program owner. Lessons learned are converted into updated checklists and shared with all participants.

• Mandatory: Maintain an incident and near-miss log that the program owner can access.
• Recommended: Run a short tabletop exercise on a payment fraud scenario for each cohort.

Implementation checklist

• Confirm a named preparer, reviewer, and approver for every financial output.
• Verify all payee or bank detail changes by calling a number already on file.
• Check that restricted files are shared only with individuals on the access list.
• Confirm that no confidential or restricted data has entered an unapproved tool.
• Recalculate key valuation outputs and record the sensitivity range.
• Log conflicts of interest and restrict trading in active target securities.
• Report suspected fraud, data exposure, or insider information immediately.
• Preserve original emails, files, and logs before making any correction.
• Record revisions with an attributed audit trail rather than overwriting work.
• Confirm applicable laws and standards with the competent authority or qualified professionals.