Building the pre-launch compliance gate no one wants to own

A claim gets flagged at 4:40pm on a Friday, in a Slack channel with three people in it, none of them on call. Nobody replies. On Monday the campaign is live, because the media buy was booked a fortnight earlier and no mechanism existed to stop it. That sequence, rather than ignorance of the rules, is how most professional firms end up explaining a promotion to a supervisor after the fact.

Take as given the supervisory picture the foundations lesson sets out, and the claim-level wording rules the fine-print lesson covers. What is left is operational and unglamorous: who signs, in what order, by when, and what survives afterwards. Nobody wants to own this. Somebody has to.

What the gate has to produce

Three outputs, and only the first one is usually treated as real: a decision, a record of that decision, and the evidence that supported it.

The record is where firms lose. Under the SEC's books and records rule for investment advisers, copies of advertisements and the supporting materials behind them are kept for five years, the first two in an easily accessible place. Most Slack workspaces, by contrast, are configured to delete messages after 90 days or a year, and design tools drop assets when a licence lapses. So the exposure outlives the evidence by a wide margin. A sign-off that exists only as a thumbs-up emoji in a channel with a short retention setting is, from a supervisor's point of view, a sign-off that never happened.

The fix is to decide deliberately where approvals live and how long they live there. Some firms export approvals into a document management system; others archive the messaging layer itself through a vendor such as Global Relay, which sells communications archiving and supervision (so treat its framing of the problem accordingly). The tool matters less than the arithmetic: set the retention of the approval record to at least the regulator's retention period, plus the limitation period for client complaints, plus the time a campaign can plausibly sit dormant before someone re-boosts it.

Worth remembering how expensive the record-keeping side alone has become. Since 2021, US regulators have brought recordkeeping cases against dozens of financial firms over business communications on unapproved channels, with penalties running into the billions in aggregate. In most of those matters the content of the messages was not the offence. The absence of a captured, supervisable record was.

The sign-off workflow: five gates, five owners

The fix is not "more review". It is *named ownership at each gate*, with a hard rule: no gate, no launch.

Gate 1: Claims inventory (owner: campaign lead, marketing)

Before design starts, list every factual claim in the copy: numbers, rankings, comparisons, guarantees, client outcomes. One row per claim, one column for "evidence source". If the row cannot be filled, the claim is a creative preference, not a claim.

Gate 2: Substantiation check (owner: subject-matter expert, not marketing)

The partner, adviser or practice lead who owns the underlying work confirms each claim against a real document (engagement result, survey, published ranking). Marketing cannot substantiate its own claims; that is the whole point of separating the gate from the creator.

Gate 3: Disclaimer mapping (owner: compliance or designated risk officer)

Apply the firm's standing claim-to-disclaimer lookup. The wording lesson supplies its content; this gate only checks that the right row was applied and that the disclaimer survives into the rendered asset. That last part fails more often than the first: LinkedIn collapses long posts behind a "see more" link, so a footnote sitting at the bottom of the copy deck is invisible on first view. Review the export, the preview and the mobile render, not the Word document.

Gate 4: Confidentiality and consent check (owner: engagement partner or account lead)

For every named or identifiable client reference, confirm a signed waiver exists, or confirm the material is anonymised well enough to stay anonymous: no name, no identifiable figures, no combination of sector, size and geography that makes the client guessable to a competitor.

Gate 5: Final sign-off (owner: legal/compliance, time-boxed)

Legal reviews the assembled package, not the raw creative, a minimum of five business days before launch. Their job here is narrow: confirm gates 1 to 4 were actually done, not redo them from scratch.

A simple tracking structure

Filled and dated, this table *is* the audit trail. Firms that can produce it on request fare better than firms reconstructing it from memory two years later, after the campaign lead has left.

Four things a clean gate still misses

Reuse and re-amplification. An asset cleared in March gets paid promotion in November, by which point the ranking it cites has been superseded. Nothing changed in the creative, so nobody re-submitted it. Rule: paid amplification, translation, or any material edit restarts the clock, and every time-sensitive claim carries an expiry date in the tracking table.

Third-party content that becomes yours. A client posts a glowing comment under a LinkedIn update and the firm replies warmly, or pins it. Supervisors have long taken the view that a firm can adopt third-party content by endorsing or curating it. Decide the house rule in advance: who monitors comments, what gets hidden, and what gets screenshotted before it is hidden.

Personal accounts. A partner posts a matter win from their own profile at 11pm. The account sits outside the workflow but not outside the firm's supervisory obligation. The workable answer is a short list of things individuals must never post without the gate (client names, outcomes, figures, rankings) rather than a policy demanding pre-approval of every personal post, which no firm has ever enforced.

Personnel change. Gate 2 substantiation frequently lives in one person's head, and Gate 4 waivers are often held on the strength of a relationship with a named client contact. When either person leaves, the evidence quietly becomes unverifiable while the asset stays live.

Why legal ends up killing campaigns anyway

Legal intervenes late when it is looped in at Gate 5 only, when the claims inventory does not exist so it is substantiating from scratch under deadline, or when confidentiality was filed as a legal problem instead of an account-team one.

Measure two numbers separately: queue time (submission to first look) and review time (first look to decision). Teams blame legal for being slow when the damage is nearly always queue time, and queue time is a staffing and intake problem, not a judgement problem. Do the capacity arithmetic before setting an SLASLAA formal commitment defining the service level a provider guarantees to a customer, with measurable targets and consequences if they are missed.View full definition →. Forty assets a month at roughly 20 minutes each, plus two hours for each of three larger campaigns, is around 19 hours: real work for a firm where compliance review is a fifth of one person's job.

Then watch the exception rate, meaning launches that went out without a completed table. Above roughly one in ten, the gate is being routed around, and a gate people route around is worse than no gate, because it produces a paper trail showing the firm knew what good looked like and shipped anyway.

A minimal governance checklist to install this quarter

• Assign named owners to each of the five gates, in writing, not "marketing and legal will coordinate".
• Set a minimum lead time (5 to 10 business days is common in mid-sized firms) between Gate 5 sign-off and launch, and publish the intake cut-off so Friday afternoon submissions stop being a surprise.
• Tier by exposure: an organic LinkedIn post from the firm page does not need the full workflow, a paid national campaign does. Write the threshold down.
• Log every waiver with a date, an expiry and a named client contact, and re-check it when either the contact or the campaign changes.
• Set the retention of approval records to outlast the applicable regulatory retention period, and test the export once a year rather than assuming it works.
• Review the FTC's Endorsement Guides (current version here) annually, since expectations on testimonials and disclosures shift.

🎬 [VIDEO: "FTC Endorsement Guides Explained" - https://www.youtube.com/results?search_query=FTC+endorsement+guides+explained - search for current FTC or legal-explainer channel walkthroughs of testimonial and endorsement disclosure rules for a plain-language primer]

Key Takeaways

• The gate produces three things: a decision, a durable record of it, and the evidence behind it. The record usually expires long before the exposure does, so set retention against the regulator's period, not the campaign calendar.
• Five named gates (claims inventory, substantiation, disclaimer mapping, confidentiality, final sign-off) with one owner each mean legal reviews a finished package rather than raw creative at midnight.
• Recordkeeping failures alone have cost financial firms billions in penalties since 2021, in matters where the content of the communications was never the issue.
• The misses are predictable: re-amplified old assets, third-party comments the firm adopts, personal accounts, and evidence that walks out with the person who held it.
• Track queue time, review time and exception rate. An exception rate above roughly 10% means people are routing around the gate, which is worse than having none.