Safety Norms: Investment Banking Analysis

1Purpose, scope, and safety principles

This document applies to any activity that produces, reviews, or relies on investment banking analysis. That includes company and industry research, discounted cash flow models, comparable company and precedent transaction analysis, leveraged buyout and merger models, pitch book figures, and due diligence data rooms. It applies to students using training files and to staff using live client or deal data.

Three principles govern every norm below. First, analysis must be accurate and traceable, because one wrong figure can change a price, a financing decision, or a disclosure. Second, no one may use confidential or non-public information to benefit themselves or others. Third, risk must be controlled at the source rather than corrected after a decision is made. A model is a spreadsheet or program that turns inputs into outputs. A control is a check or limit that prevents or detects error or misconduct.

2Roles, competence, and accountability

The analyst builds and documents the work. The reviewer checks inputs, logic, and conclusions before release. The supervising associate, vice president, or director approves material outputs and owns the client relationship. The compliance function sets rules on restricted lists, information barriers, personal trading, and gifts. Information technology and security teams control access and system settings. In training settings, the instructor owns the practice environment and assessment rules.

Competence means demonstrated ability with the specific tool and method, not only attendance at a course. Staff must not present valuation outputs, fairness analysis, or disclosure support they have not been trained and supervised to produce.

• MANDATORY: Every deliverable must name a preparer and an independent reviewer in the file header or version log.
• MANDATORY: No person may be the only check on a figure that feeds a client, board, or public document.
• MANDATORY: Only staff with completed training on the relevant policies may access live deal data. Trainees use anonymized or synthetic data unless a supervisor authorizes otherwise in writing.
• MANDATORY: Anyone who finds an error in a released model must notify the model owner and the reviewer the same working day.

3Course-specific hazards and risk assessment

The main risks in this subject are financial, legal, and informational rather than physical, but they can cause serious harm. Ratings below are qualitative. High means likely to cause material loss, misstatement, or legal exposure if uncontrolled. Medium means likely to cause significant error or delay. Low means limited impact that can be corrected in routine review.

Each engagement or training project must have a documented risk assessment before live work begins. Record the activity, the hazard, who is exposed, existing controls, the residual rating, and the owner of any follow-up action. Reassess when scope, data sources, team members, or deadlines change.

• Spreadsheet error, such as broken links, hard-coded numbers inside formula rows, mixed units, or mismatched periods. Rating: high. Example: a share count entered in thousands on one tab and in millions on another.
• Biased or unsupported assumptions, such as growth rates with no source or peer sets chosen to reach a target value. Rating: high.
• Misuse of material non-public information, such as trading in a target company's shares or passing deal timing to a relative. Rating: high, with possible securities law and firm policy breaches.
• Information barrier breaches, such as discussing a restricted transaction in an open area or sharing a data room password. Rating: high.
• Data leakage through personal email, consumer file sharing, or unapproved AI tools. Rating: high.
• Phishing that requests wire details, credential resets, or data room access. Rating: high.
• Unverified market data from unreliable sources. Rating: medium.
• Fatigue and deadline pressure during late build sessions, which increases copy-paste errors and skipped checks. Rating: medium.
• Strain from long screen sessions and poor workstation setup. Rating: low to medium.

4Preventive controls and safe work practices

Preventive controls stop errors and misconduct before they reach a decision. Items marked MANDATORY are firm minimums for this course. Items marked RECOMMENDED are good practice that supervisors may require. Where a rule depends on a firm policy, regulator, or local law, verify the current requirement with compliance or legal counsel before relying on it.

Treat the following as red flags requiring escalation: requests to bypass review, unexplained changes to outputs close to a deadline, pressure to reach a specific valuation, unusual payment instructions, and requests to share credentials. Do not investigate alone, alter evidence, or confront the person involved.

• MANDATORY: Build models from an approved, version-controlled template with a cover tab listing sources, currency, units, period ends, version number, and preparer.
• MANDATORY: Separate inputs, calculations, and outputs. Hard-coded numbers appear only on the input tab, each with a stated source reference.
• MANDATORY: Run a documented integrity check before circulation, covering balance checks, sign checks, error cells, circularity switches, and cross-tab totals.
• MANDATORY: Every assumption needs a stated rationale and source. Key drivers such as growth, margin, discount rate, and exit multiple must show sensitivity ranges.
• MANDATORY: The reviewer must trace a sample of links from each key output back to source and record the review in the version log.
• MANDATORY: Do not change a released version. Create a new version number and log the change, the reason, and the person responsible.
• MANDATORY: Comparable company and transaction sets must record selection criteria and exclusions. Changes to the peer set require reviewer sign-off.
• MANDATORY: Confirm market data against a second approved source before using it in any valuation shared outside the working team.
• MANDATORY: Segregation of duties applies to deal and financing systems. The person who enters a payment, creates a vendor record, or changes master data must not also approve it.
• MANDATORY: Check the restricted list and information barrier status before discussing a company, trading in its securities, or sending materials outside the team.
• MANDATORY: Never trade, recommend trades, or tip others based on material non-public information. If in doubt, stop and escalate to compliance before acting.
• MANDATORY: Do not use personal accounts, personal email, or unapproved AI tools for client or deal information.
• RECOMMENDED: Use a second reviewer for any output that will appear in a client presentation, board paper, or disclosure support.
• RECOMMENDED: Complete a deliverable checklist covering figures, labels, footnotes, and disclaimers.
• RECOMMENDED: Hold a peer walkthrough before deadlines rather than relying on a late review.

5Equipment, environment, information, and protective safeguards

Spreadsheets, databases, data room platforms, financial data terminals, collaboration tools, and printers each carry specific exposures. Use only hardware and software approved and configured by the firm's technology team. Multi-factor authentication, screen locks, encryption, audit logging, and periodic access reviews are commonly expected safeguards, but the exact requirements depend on firm policy and applicable data protection and financial services rules, which must be confirmed with the security and privacy teams.

Training environments should use synthetic datasets and clearly labeled practice files so that no real client information enters coursework.

• MANDATORY: Store deal files only in approved, access-controlled repositories with audit logging. Do not keep local copies on removable media unless approved in writing.
• MANDATORY: Lock your screen whenever you leave your workstation, and do not review confidential material in shared or public spaces.
• MANDATORY: Store printed deal materials in locked containers and destroy them with the approved shredding process when no longer needed.
• MANDATORY: Grant access to data rooms, models, and restricted folders by named role, and remove access promptly when a role or project ends.
• MANDATORY: Never share login credentials, tokens, or data room passwords. Verify any payment or credential change request by calling a known number, not a number supplied in the request.
• RECOMMENDED: Use privacy screens in open offices and keep monitor height and posture set to reduce strain during long model builds.
• RECOMMENDED: Take scheduled breaks during intensive build periods, and avoid final checks when fatigue is high.

6Incident reporting, emergency response, and escalation

An incident is any event that exposes confidential information, sends a wrong figure to a client or counterparty, breaches an information barrier, involves suspected fraud, or disrupts a deal system. A near miss is an event that could have caused harm but was caught in time, such as a wrong total found during review. Both must be reported. Reporting an honest mistake is expected; concealing one is a serious breach.

Physical emergencies such as fire, medical events, or threats to building security are handled under the building emergency plan, and anyone in immediate danger should call local emergency services first. Suspected cyber incidents, such as malware, a phishing click, or compromised credentials, should be reported to the security contact immediately, and devices should be isolated only as the security team directs.

• Step 1: Stop further use of the affected file, account, or device, and preserve it. Do not delete emails, files, or logs.
• Step 2: Notify your supervisor and the compliance or security contact at once, within any shorter timeframe set by firm policy.
• Step 3: Record what happened, what you saw, who was involved, and what was changed. Stick to facts and avoid speculation.
• Step 4: Corrections to released material require supervisor approval. Client-facing leads decide, with compliance, whether and how recipients are told.
• Suspicious activity, such as unusual trading patterns, requests to bypass controls, or unexplained fund transfers, goes directly to compliance. Do not contact the person involved to test the concern.
• Escalate to legal counsel where a disclosure obligation, regulatory notice, or privilege issue may arise. Use the firm's confidential reporting channel when conduct may be unlawful, consistent with applicable whistleblower law.

7Records, training, inspection, and review

Records show what was done, by whom, and why. Version logs, review sign-offs, risk assessments, training completion, access approvals, control overrides, and incident reports must be complete, legible, and never altered after the fact. Retention periods depend on firm policy and applicable legal requirements, which must be verified with qualified professionals.

Review this safety norm set after each engagement cycle and after any significant incident, regulatory change, or system change. Track indicators such as review exceptions, late access removals, and near-miss reports, and use them to improve controls rather than to assign blame.

• MANDATORY: Maintain a version log in every model showing version number, change summary, preparer, reviewer, and approver.
• MANDATORY: Complete initial and refresher training on information barriers, confidentiality, and model controls before accessing live work.
• MANDATORY: Record every override of a control, including who approved it, why, and what compensating check was applied.
• RECOMMENDED: Audit a sample of models each cycle using the deliverable checklist, and report exceptions to the supervisor.

8Conclusion and limits of this guidance

This guidance is educational. It does not replace formal professional training, firm policy, supervision, legal advice, or regulator-approved procedures. Securities, banking, data protection, and anti-fraud rules differ by jurisdiction and change over time, so verify current versions with compliance, legal counsel, or competent authorities. Use this document as a starting point for locally approved procedures, and never allow deadline pressure to override a control.

Implementation checklist

• Confirm you hold current authorization and training for the data and tools you plan to use.
• Check the restricted list and information barrier status before discussing or trading in any company.
• Keep every model in an approved, version-controlled repository with a complete version log.
• Separate inputs, calculations, and outputs, and complete the integrity check before circulation.
• Have an independent reviewer trace key outputs to sources and record sign-off.
• Verify payment or credential change requests through a known independent channel.
• Never send confidential material to personal accounts or unapproved tools.
• Lock your screen and secure printed materials whenever you leave your workstation.
• Report errors, near misses, and suspicious activity to your supervisor or compliance without delay.
• Do not alter evidence or investigate suspected misconduct on your own.
• Verify current laws, standards, and firm policies with qualified professionals.