Documentation is Not a Dialogue

The SEC has decided it’s tired of arguing. The enforcement action against ISS over subpoena noncompliance isn't just a spat between two bureaucracies; it's a signal that the regulator is moving past "what happened" and focusing on "why can't I see the files."

When a firm refuses to provide documents during an investigation, they aren't protecting proprietary secrets. They're admitting their evidence trail is either non-existent or damning. From where I sit, there's no such thing as a 'mature' compliance programme if it collapses the moment a subpoena hits the desk. If you can't produce the requested records on a random Tuesday afternoon without three weeks of internal panic and a legal review, your controls are decorative.

The logic here is simple. The regulator doesn't care about your intent; they care about the audit trail. This week's focus on proxy advisers suggests a shift in target. For years, the pressure was on the issuers. Now, the SEC is squeezing the middlemen who influence how those issuers are governed.

The second-order effect here hits the investment funds and pension schemes that rely on these advisors. If a proxy advisor is under regulatory scrutiny for failing to produce documents, every piece of advice they've issued becomes suspect. The liability doesn't stop at ISS. It flows downstream to the fiduciaries who checked a box saying they relied on "independent" third-party expertise. I expect insurers to start tightening the screws on D&O policies, specifically looking for clauses that penalise firms whose service providers are actively fighting subpoenas.

Someone will argue that this is an overreach—that certain documents are privileged or too sensitive to hand over without a fight.

That's a legal argument for a courtroom, not a compliance strategy. In my experience, the people who spend the most time arguing about "privilege" are usually the ones who didn't keep the logs in the first place. Privilege is a shield you use after the fact; it isn't a substitute for an actual record-keeping policy.

We see the same friction in other corners of the market. While some are celebrating things like GCash getting the nod for a P92 billion IPO, others are finding out that gaps in data oversight have immediate price tags. The CNIL just hit a French hospital for half a million euros after just under 730,000 records were compromised. That's not a failure of technology; it's a failure of the 'Tuesday test.' If an assessor asked to see the access logs for those specific records, the answer was likely a shrug and a request for more time.

The pressure is concentrating on the facilitators—the advisors, the proxy firms, the data handlers. They are no longer invisible pipes.

The question for anyone in these sectors is whether your evidence is actually there or if you've just been lucky enough that nobody has asked to see it yet. I'll believe a programme is 'mature' when the person providing the documents doesn't look like they're about to vomit.