Compare Employee Communications Against Sec Referral

Skill: Compare Employee Communications Against SEC Referral Notice — Defense-Side Gap Analysis

2. Failure modes the skill is correcting

• The memo treats the SEC referral notice as self-proving instead of testing it against the company’s actual communication record.
• Relevant employee messages are compared in the aggregate, masking date-specific gaps, BYOD capture issues, and custody/source differences.
• An unexplained gap is described without first ruling out ordinary causes such as migration, retention settings, device loss, or platform non-capture.
• An instruction not to discuss the matter is treated as routine confidentiality rather than a potential obstruction, evidence-preservation, or whistleblower-suppression indicator.
• The timing of management communications is not tied to the investigation timeline, weakening the inference analysis.
• The write-up stops at problem spotting and does not state the downstream litigation, regulatory, or privilege consequence.
• Recommendations are omitted or too generic to support immediate defense-side triage.
• Legal conclusions are stated without naming the governing rule, statute, regulation, or doctrine.

3. Legal frameworks / domain conventions that apply

SEC referral notice as comparison anchor:

• The referral notice frames alleged conduct, relevant custodians, date ranges, and categories of communications the SEC believes are material.
• The defense task is to compare that framing against collected employee communications and related documents to identify corroboration, contradiction, missing periods, and source-specific limitations.

Communication-gap analysis:

• Treat company-maintained records, archived systems, and personal-device communications as distinct populations.
• A gap is only probative after confirming the search universe, retention settings, and any technical or administrative explanation for non-capture.
• If no innocent explanation is documented, state that absence affirmatively and explain why it matters.

Obstruction and evidence-preservation exposure:

• Instructions not to discuss a matter, when linked to an inquiry, subpoena, complaint, or hold notice, may implicate obstruction or preservation duties.
• Anchor any such assessment to the governing source identified in the materials or to the applicable federal obstruction and evidence-preservation standards, including 18 U.S.C. §§ 1503, 1512, and Federal Rule of Civil Procedure 37(e) where preservation issues arise.

Whistleblower-suppression / retaliation concerns:

• Communications that discourage reporting to regulators or retaliation for reporting may implicate anti-retaliation and whistleblower protections.
• Cite the applicable securities-law source for the proposition relied on, including Exchange Act Rule 21F-17, 17 C.F.R. § 240.21F-17, and any other authority identified in the record.

Privilege and defense posture:

• The memorandum is privileged and should separate fact collection, legal risk assessment, and recommended next steps.
• Do not overstate conclusions where the source set is incomplete; identify what is known, what is missing, and what should be collected next.

4. Analytical scaffolds

1. Scope the comparison universe: Identify the custodians, systems, and time periods covered by the SEC referral and by the collected documents; if the record set is clearly limited to one relevant period or one communication channel, say so.
2. Match allegation to record: For each allegation or document reference in the referral notice, locate the corresponding employee communication, archive hit, or absence of a hit.
3. Test for corroboration or contradiction: Determine whether the communications support, undermine, or fail to address the referral’s narrative.
4. Evaluate any gap: For each missing period or missing custodian/channel, determine whether there is an innocent explanation in the record; if none appears, state that the gap is unexplained.
5. Assess source limitations: Distinguish between company records, personal devices, and third-party or ad hoc channels so that a source limitation is not mistaken for spoliation.
6. Assess instruction language: Identify any direction not to discuss, not to memorialize, or not to escalate; evaluate whether it is tied to a compliance inquiry, government contact, or complaint.
7. Tie timing to the investigation: State the date of the instruction and compare it to the start of the inquiry, hold, referral, subpoena, or complaint.
8. State the defense consequence: For each issue, explain whether the consequence is evidentiary weakness, preservation risk, obstruction exposure, whistleblower-suppression exposure, or a privilege-management issue.
9. Cite the governing authority: Name the statute, regulation, rule, or doctrine supporting each legal proposition used in the assessment.

5. Vertical / structural / temporal relationships

• Organize the analysis by chronology when timing drives the inference: alleged conduct period, first complaint or inquiry, hold implementation, and later communications.
• Distinguish upward and downward communication flows when management instructions may have been relayed through intermediaries.
• Separate company-controlled systems from off-system communications; a record gap in one does not prove absence in the other.
• Where multiple custodians or channels are involved, address each separately rather than collapsing them into a single narrative pass.
• Note whether a communication occurred before, during, or after the triggering event; proximity often changes the risk analysis.

6. Output structure conventions

• Deliver a privileged defense-side gap analysis memorandum in conventional memo form with a short executive summary followed by numbered issues.
• Open with a concise scope statement identifying the source set reviewed, the time period, and any material limitations.
• Define one ordinal severity scale at the top and apply it consistently to every issue, such as Critical / High / Medium / Low.
• For each issue, include:
  • the SEC allegation or document reference being tested;
  • the relevant employee communication record or absence of record;
  • the gap, corroboration, or contradiction identified;
  • the innocent-explanation check and whether it was satisfied;
  • the governing authority for any legal proposition cited;
  • the downstream consequence for the client;
  • the severity rating.
• Close each issue with a concrete action-oriented recommendation tied to the responsible role and the relevant milestone or urgency.
• Include a final Recommended Actions section covering supplemental collection, hold review, privilege handling, custodian follow-up, and any need for individual-counsel coordination.
• Keep the tone defensive, precise, and document-driven; avoid conclusory assertions unsupported by the source set.