The approved playbook tells an adviser to interview employees, obtain records and prepare evidence for a foreign proceeding. Headquarters has cleared the vendor and the objective. The instruction then crosses into France, a Singapore data set and a private tribunal. Each crossing changes the authority needed to perform the work.
The failure starts in the document. A broad line such as “investigate the counterparty” conceals several legally different acts. Procurement sees one supplier. Legal sees the mandate that was originally approved. The operator sees permission to start. Nobody can tell which interview, search, transfer or procedural use received clearance.
Set the mandate before drafting the methods. Early drafting makes the writer choose priorities and legal assumptions without authority. The neatest action sequence can pursue the wrong outcome or rely on a method the sponsor never accepted.
Issue a mandate naming the sponsor, planning owner, approval authority, scope, required outcomes, protected interests and document classification. Then record dependencies, constraints, assumptions, applicable obligations and unresolved decisions. NIST SP 800-34 Rev. 1 puts strategy before plan development in its seven-step process. JP 5-0 requires assumptions to remain logical, realistic and essential, with continual review.
You now have a planning basis against which counsel can clear conduct. It should say whether the required outcome is advice to a board, admissible evidence, a lawful interview record or assets identified for a recognised process. Those outcomes can demand different routes through the same country.
Turn every instruction into a clearable act. Legal review fails when it attaches to a heading or workstream. “Conduct due diligence” leaves the performer, location, source and intended use unstated. Counsel then approves a category while the operator chooses the conduct later.
Write one accountable role, an observable start condition, required inputs, expected output, dependencies and a completion or escalation condition for every action. Add a time requirement only where the mandate or evidence supports it. “France investigation lead interviews the named employee after local licence and data clearance; produces an attributed note; stops if the employee requests counsel” gives the review a real object.
Keep reasoning outside the operative instruction. The user needs to scan the act without mistaking legal commentary for permission. Link the approval record to the action identifier, performer, place and permitted method. A changed method then produces a visible clearance gap.
Classify the activity before relying on the supplier. Branding travels more easily than legal authority. A global investigations firm can lawfully advise from one office while its field enquiry triggers an occupational gate elsewhere. The contract location does not settle where the act occurs.
The dated UK position shows the risk. As at 10 March 2022, the Security Industry Authority said private-investigator regulation had not been implemented and it had no plan to regulate without a government decision. France uses a different structure. CNAPS guidance requires operator authorisation, managerial approval and a professional card; an investigating manager has also needed a card since 26 November 2022.
Check the contracting entity, supervising entity and individual performer separately. French cards and manager approvals last five years, with renewal requested at least three months before expiry. California ordinarily requires three years or 6,000 hours of paid investigative experience and issues a two-year licence. These are entry gates. They do not approve a particular recording, database search or interview.
Separate licensing from method and data clearance. A valid occupational permission can coexist with an unlawful means of collection. Method review fails when the team treats publicly obtainable information as freely reusable, or assumes a local vendor absorbs the client’s data obligations.
Map each data set by subject, field, source, collection method, recipient, storage location, transfer and intended use. In the United Kingdom, Article 10 creates a distinct condition for criminal-conviction and offence data. The ICO frames legitimate interests through a three-part purpose, necessity and balancing test, and says covert worker monitoring should be exceptional.
US restrictions show another method boundary. 15 U.S.C. 6821 prohibits obtaining financial customer information through false or fraudulent representations. The Telephone Records and Privacy Protection Act of 2006 uses 18 U.S.C. 1039 against fraudulent acquisition and knowing receipt of confidential phone records. Your action clearance should therefore name both the lawful source and the permitted collection method.
Clear the transaction forum on its own terms. Intelligence changes legal character when it enters a board contest or regulated solicitation. A playbook copied between transactions can direct the same research toward a different decision-maker under different controls.
In a UK public takeover, Takeover Code Rule 3 requires competent independent advice for the offeree board. Rule 21 restricts frustrating action without shareholder approval. A US contested director election uses Rule 14a-19, which requires both proxy cards to list all duly nominated candidates and prescribes grouping and alphabetical order within groups. The annex must state which decision the product supports and who may act on it.
Test the evidence route beyond the treaty name. A convention citation gives a channel, while destination rules decide how that channel works. The Hague Evidence Convention separates these questions. Article 9 ordinarily applies local procedure, Article 11 preserves specified privileges, and Article 23 permits declarations against pre-trial document discovery.
Tribunal character requires a separate check. In ZF Automotive, 596 U.S. (2022), the US Supreme Court limited 28 U.S.C. 1782 to governmental or intergovernmental adjudicative bodies. The private commercial and ad hoc investment panels before it fell outside the provision. “Arbitration evidence” is too broad to clear an instruction.
Read the local implementing text as well. As of 19 September 2026, UNCITRAL recorded legislation based on its 1997 Cross-Border Insolvency Model Law in 63 states covering 66 jurisdictions. Inclusion in that total does not make enactments identical. Access, recognition, relief and cooperation depend on the national text and commencement provisions.
Create an annex only when the operating act changes. Country summaries become stale libraries because they repeat law without changing what anybody does. They also hide the few local conditions that matter during release.
Create a jurisdiction annex when place or forum changes an action, owner, resource, authority, output or escalation condition. Put the changed instruction beside its clearance condition. Keep common actions in the controlled core. This makes the annex a usable delta rather than a second playbook.
You should be able to remove that annex without changing instructions for every other cleared place. If you cannot, the core and local delta have been mixed.
Approve an identified version and its conditions. Approval attached to a filename survives silent editing. The operator can no longer prove which facts, law or methods the approver considered. NIST SP 800-53 Rev. 5 control CP-2 requires review, approval, distribution, updating, change communication and protection for US federal system plans.
Record the version, planning basis, cleared action identifiers, jurisdictions, forums, conditions, expiry points, unresolved items and permitted deviations. Release one authoritative copy and mark superseded copies unmistakably. Approval should show the exact annexes in force.
Reopen clearance when the operating basis moves. A location change can trigger licensing. A new recipient can change data authority. A different tribunal can close an evidence route. Small edits can therefore invalidate the legal analysis while leaving the objective untouched.
Use both periodic and event-driven maintenance. Reopen the affected actions when the location, forum, tribunal character, evidence route, data set, performer or instruction changes materially. For US FINRA member firms, Rule 4370 requires at least annual review and an update after material changes to operations, structure, business or location. Your broader event list should follow the actual legal dependencies in the mandate.
Retrieve the approved baseline, replace resolved assumptions with facts and reclear the delta. Publish the new identified version, notify its users and retain the earlier decision record. The release test is direct: every act can be traced to its current owner, condition, output and jurisdiction-specific authority before anyone starts.