Sample · Illustrative firm · Version 1
A 25-person wealth advisory firm
- Prepared by
- Sidekick Orchestration, with the operations lead
- Reviewed by
- Compliance lead
- Next review
- 30 days after setup
01Scope
In scope
- Pre-meeting briefs for advisors, built from the calendar, recent email and meeting notes.
- Follow-up email drafts after client meetings.
- Draft CRM notes for the advisor to check and save.
Out of scope
- Investment recommendations, suitability assessments or trades.
- Anything sent to a client without a person reviewing it first.
- Account statements, the dealer back office and the trading platform.
02Tools and accounts
- AI tool
- Microsoft 365 Copilot, business licences for six users.
- Account owner
- The firm. The IT provider holds the admin role.
- Training on firm data
- Off under the provider’s business terms. Checked with the IT provider on setup day.
- Where data is stored
- Governed by the provider’s terms for the firm’s account. The IT provider confirmed the settings.
- Sidekick access
- None. Sidekick holds no passwords or admin rights.
03Connections
| Source | What the AI can do | Approved by |
|---|---|---|
| Advisor mailboxes | Read and draft. Cannot send. | Compliance lead; set up by the IT provider |
| Advisor calendars | Read. | Compliance lead; set up by the IT provider |
| Meeting notes folder | Read only this folder. | Compliance lead; set up by the IT provider |
| CRM | Draft notes. The advisor saves them. | Compliance lead and operations lead |
| Not connected | Trading platform, dealer back office, account statements. | Decision recorded here |
04Data rules, written into the AI’s settings
- Never put social insurance numbers, account numbers, passwords or health details into a prompt or a draft.
- Use client initials in internal summaries where you reasonably can.
- Never state or imply investment advice, expected returns or suitability in a draft.
- Flag, and do not draft, anything about complaints, trade instructions or changes to know-your-client information. Send it to the compliance lead.
05Human review
- The advisor reads, edits and sends every client-facing draft. Nothing sends automatically.
- The advisor checks the recipient before sending.
- The advisor reads each CRM note before saving it.
- Anything flagged by the rules above goes to the compliance lead.
06Records
- Sent emails
- Kept in the firm’s mail archive, as today.
- CRM notes
- Saved in the CRM by the advisor, as today.
- Unsent AI drafts
- Firm decision, recorded here by the compliance lead: not treated as client records.
07Changes and incidents
Every issue is logged with the date, what happened, the fix and any new rule. New connections need the compliance lead’s approval. The operations lead reviews this record every 30 days.
Example log entry
What happened: a follow-up draft copied an account number from an email thread.
Caught: by the advisor at review. Nothing was sent.
New rule: remove account numbers from every draft, even when they appear in the source.
08Roles
| Role | Who | Responsible for |
|---|---|---|
| Sponsor | Managing partner | Owns the priorities and approves any expansion. |
| Compliance lead | Chief compliance officer | Approves connections and data rules. Reviews this record. |
| Operations lead | Operations manager | Keeps the written procedures current. Runs the monthly review. |
| IT provider | Managed IT provider | Makes every system change, on the compliance lead’s approval. |
| Sidekick | Chase Bernier | Coaches the team and writes this record. No system access. |
09Sign-off
Compliance lead, name and date
Managing partner, name and date