Safety Norms: Mergers, Acquisitions and Corporate Restructuring

1Purpose, Scope, and Safety Principles

These norms set out how people working on mergers, acquisitions, and corporate restructurings should protect employees, customers, confidential information, and the organization. They cover target screening, due diligence, valuation, negotiation, financing, signing, closing, integration, divestitures, spin-offs, carve-outs, workforce reductions, and debt restructurings. They apply to employees, contractors, and external advisers working on a transaction.

Most harm in this field is financial, legal, informational, or human rather than physical. Consequences include insider trading liability, regulatory penalties, misleading disclosures, unlawful employee selection, data exposure, and integration failures that hurt staff and customers. Physical hazards arise mainly during site visits, plant inspections, and closures and are addressed in later sections.

Mandatory rules are marked MUST. Recommendations are marked SHOULD. Any item that depends on law, regulator rules, or contract terms is jurisdiction-dependent and must be confirmed with qualified counsel or the competent authority before use.

2Roles, Competence, and Accountability

Accountability must be named for each transaction. The executive sponsor approves the deal team roster, chairs stage-gate sign-offs, and remains accountable for process compliance. Each function holds specific duties that cannot be handed off informally.

Competence is required before access. Only people who have completed documented training on material non-public information, confidentiality, and data handling may join a deal team. Specialists in tax, pensions, environmental liability, and employment law must be consulted on their areas. Anyone unsure whether they are authorized must stop and ask the compliance officer.

• Deal lead: maintains the timetable, chairs stage-gate reviews, and confirms every participant has signed a confidentiality undertaking before access is granted.
• Legal counsel: owns confidentiality agreements, disclosure schedules, regulatory filing strategy, and clean team arrangements.
• Compliance officer: maintains the restricted list and insider list, reviews trading requests, and records conflict of interest declarations.
• Finance lead: owns valuation models, assumptions, version control, and the record of who approved each output.
• Human resources lead: owns employee communications, consultation steps, selection criteria, and retention arrangements.
• IT security lead: administers data room permissions, multi-factor authentication, encryption settings, and access logs.
• Advisers and contractors: must be bound by engagement letters with confidentiality, data protection, and conflict terms, and must use approved channels only.

3Course-Specific Hazards and Risk Assessment

Risk assessment must be completed at the start of each stage and updated at each stage gate. Score each hazard for likelihood and severity as High, Medium, or Low, then assign a control owner and a review point. The list below is not exhaustive. Teams must add hazards specific to their target, sector, or jurisdiction.

Record the reasoning behind each rating in the deal file, not only the score. A High rated risk must not advance to the next stage until the control owner confirms the control is in place and working.

• Leakage of material non-public information (High): can lead to insider trading, tipping, and market disruption. Controlled by restricted lists, insider lists, code names, and trading blackouts.
• Conflicts of interest (High): personal stakes can bias valuation or advice. Controlled by declarations, independence checks, and separate reviewers.
• Overstated valuation or synergies (High): can cause overpayment and misleading board or investor statements. Controlled by model review and sensitivity testing.
• Misleading disclosure or forward-looking statements (High): creates regulatory and litigation exposure. Controlled by counsel review and a disclosure committee.
• Data breach through data rooms, email, or devices (High): exposes personal and commercial data. Controlled by access controls, watermarks, and approved storage.
• Unlawful or unfair workforce reduction (High): may breach consultation rules and harm employees. Controlled by documented selection criteria and counsel review.
• Integration failure, system outages, and key person loss (Medium): disrupts customers and operations. Controlled by integration planning, retention plans, and continuity testing.
• Physical hazards during site visits and closures (Medium): machinery, slips, falls, and hazardous materials. Controlled by site induction and host site rules.
• Environmental liabilities at target sites (Medium to High): legacy contamination or waste can create cleanup costs and penalties. Controlled by qualified environmental assessment before signing.
• Fatigue and stress during long transaction periods (Medium): reduces judgment and increases error. Controlled by rotation, handovers, and rest planning.

4Preventive Controls and Safe Work Practices

The rules below are mandatory unless compliance has issued a written exception. Exceptions must be time limited and recorded in the deal file.

Recommended practice goes further. Release information in stages, starting with the minimum needed for each decision. Hold a short pre-mortem at each stage gate, asking how information could leak, how a decision could be wrong, and who could be harmed. Run integration planning with staff who are cleared only for the information they need.

Everyday habits matter. Lock screens when leaving a desk, avoid discussing transactions in lifts, public transport, or open-plan areas, and keep printed material out of shared spaces. If a conversation may be overheard, end it and report the concern.

• MUST sign a confidentiality undertaking before receiving any deal information.
• MUST add every person with deal access to the insider list when they first receive information, and notify them in writing of their obligations.
• MUST NOT trade, recommend trades, or disclose information about any party while holding material non-public information. Trading requests go to compliance before execution.
• MUST use code names for targets and bidders in internal messages, emails, and calendar entries.
• MUST store deal documents only in the approved data room or approved system, labeled with the classification set by counsel.
• MUST NOT use personal email, personal messaging apps, or unmanaged cloud storage for deal content.
• MUST route competitively sensitive information through a clean team approved by counsel before any sharing with competitor personnel.
• MUST have every valuation model version reviewed by a second qualified person before a decision maker sees it.
• MUST have every public statement and investor communication cleared by legal counsel and the disclosure committee.
• MUST complete a documented selection and consultation process before notifying affected employees of role reductions.
• MUST sign in, complete site induction, use required protective equipment, and stay with an escort during any site visit.

5Equipment, Environment, Information, and Protective Safeguards

Technology and physical settings are part of the control framework. Standard requirements include company managed devices, multi-factor authentication, encryption for data at rest and in transit, and remote wipe for mobile devices. Exact product settings must be confirmed with the IT security lead and current vendor documentation, which varies by product and version.

Workplace welfare supports sound judgment. Plan long review periods with breaks, rest, and handovers. Workstations for extended review should meet local ergonomic standards. Specific obligations depend on local employment law.

• Virtual data rooms: MUST use named users, least privilege permissions, watermarks, audit logging, and download or print restrictions where appropriate. Access must be revoked promptly when a person leaves the deal.
• Audit logs: SHOULD be reviewed at each stage gate and whenever an unusual access pattern is reported.
• Meeting rooms: MUST be closed and free of speakerphones for confidential discussions. Recording devices are not permitted in deal meetings without written approval.
• Physical records: MUST be kept in locked storage and destroyed only through approved secure destruction, with a destruction record.
• Personal data: MUST be minimized in data rooms, with employee records redacted to what the decision requires, in line with applicable data protection law.
• Industrial sites: MUST follow the host site requirements, which may include safety boots, high visibility clothing, eye protection, and hearing protection. Visitors must not enter restricted zones or handle equipment without qualified supervision.
• Environmental controls: MUST obtain a qualified environmental assessment where a target has industrial use, contamination history, or hazardous material storage. Sampling and handling of hazardous materials must be done only by qualified professionals.

6Incident Reporting, Emergency Response, and Escalation

Speed matters. Suspected leaks, unexpected approaches from journalists or investors, suspicious trading, lost devices, and data room misconfigurations must be reported immediately to the compliance officer and the deal lead. The reporting timeline must be set by compliance and written into the deal procedures.

After any incident, the deal lead must arrange a post-incident review within a set timeline. The review records what happened, the root cause, corrective actions, owners, and deadlines, and tracks each action until closed. Serious legal or regulatory incidents require formal advice from qualified counsel and, where relevant, emergency services or the competent authority.

• MUST report suspected leaks, suspicious trading, and unexpected approaches immediately, without attempting a private investigation.
• MUST preserve evidence: do not delete emails, messages, or files, and do not alter access logs.
• MUST ask IT security to suspend any affected account or data room user while the matter is reviewed.
• MUST NOT respond to media, investors, or competitors about the transaction. Refer all enquiries to the approved spokesperson.
• MUST escalate any personal data breach to legal counsel, who decides whether regulators or affected people must be notified and within what timelines, which are jurisdiction-dependent.
• Physical emergency at a site: MUST follow the host site emergency plan, call emergency services, evacuate when instructed, and account for all visitors at the assembly point.
• Injury: MUST summon a qualified first aider or emergency services. Untrained staff must not provide treatment beyond the site's approved first aid procedure.

7Records, Training, Inspection, and Review

Good records prove that controls were used, not only written. The deal file must contain the risk assessment, insider lists, conflict declarations, approvals, valuation model versions with reviewer sign-offs, disclosure clearances, clean team agreements, and data room access logs.

Useful internal measures include the number of access exceptions, late insider list updates, unreported concerns, overdue corrective actions, and training completion. These are management indicators for improving practice, not external benchmarks, and should not be used to assign blame.

• Retention: keep records for the period required by legal and internal retention policy, which varies by jurisdiction and must be confirmed with counsel.
• Training: all deal participants must complete training before access and attend refresher sessions at intervals set by compliance, with attendance recorded.
• Inspection: compliance reviews insider lists, access exceptions, and trading requests at each stage gate.
• Site safety: qualified personnel inspect visitor arrangements and environmental controls for sites in scope, and record findings.
• Review: the deal lead holds a lessons learned review after closing or termination and updates these norms where gaps were found.

8Verification and Professional Advice

This document is an educational starting point for locally approved safety and compliance procedures. It does not replace qualified legal, tax, accounting, employment, environmental, or cybersecurity advice, formal training, supervision, or the authority of the competent regulator.

Securities, competition, employment, data protection, and environmental requirements differ by jurisdiction and change over time. Verify current requirements with competent authorities and qualified professionals before relying on any norm in a live transaction.

Implementation checklist

• Confirm each participant has signed a confidentiality undertaking and appears on the insider list before access is granted.
• Use code names in all internal messages, emails, and calendar entries.
• Route all trading requests from restricted persons to compliance before execution.
• Confirm data room permissions, watermarks, and audit logging are active and reviewed at each stage gate.
• Have a second qualified reviewer sign off every valuation model version before presentation.
• Clear all public statements and investor communications with counsel before release.
• Complete documented selection and consultation steps before any employee notification.
• Complete site induction and use required protective equipment before any site visit.
• Report suspected leaks or breaches immediately and preserve all evidence without investigating alone.
• Record risk assessments, approvals, and lessons learned in the deal file and update these norms.