Safety Norms: Mergers and Acquisitions Advisory

1Purpose, Scope, and Safety Principles

These norms protect clients, colleagues, counterparties, and the firm from harm arising from advisory work on mergers, acquisitions, joint ventures, carve outs, and business sales. In this field, most harm is informational, legal, financial, or reputational. Physical risks arise mainly from site visits, travel to closings, and long working hours.

The scope covers all staff, contractors, and interns who handle deal information, prepare valuation or financial materials, attend meetings, travel to target sites, or communicate with buyers, sellers, lenders, and regulators. Rules marked as must are mandatory. Items marked as should are recommendations. Legal and professional requirements are jurisdiction dependent and must be verified with qualified counsel and the relevant regulator.

• Must: treat all non-public deal information as confidential and share it only on a need-to-know basis.
• Must: do not give personal investment advice or trade in securities of any party to a live transaction without prior compliance clearance.
• Should: when facts are uncertain, choose the more cautious option and escalate rather than guess.

2Roles, Competence, and Accountability

The engagement partner or lead adviser is accountable for approving the deal team, confirming who may receive deal information, and ensuring conflicts are cleared before work begins. The deal team leader manages daily tasks, including the deal contact list, confidentiality log, data room permissions, and timetable. The compliance officer maintains restricted lists, reviews conflicts, and approves exceptions. The information technology lead controls system access and responds to security alerts. Every team member is responsible for following these norms and reporting problems without delay.

Competence means being assigned only to tasks matched to current training and experience. Staff without training in securities rules, data protection, and competitively sensitive information handling must not receive that information. Specialist advisers, such as tax, pension, employment, or environmental experts, must be engaged through a formal scope letter and must work only within their qualifications.

• Must: confirm conflict checks and engagement authorization before accessing any deal data.
• Must: assign a named person to each data room, mailbox, and shared folder, and record that assignment in the deal file.
• Should: pair newer staff with a supervising team member for client calls and negotiation sessions.

3Hazards and Risk Assessment

Realistic hazards include unauthorized disclosure of a pending deal, which can move share prices and expose the firm to liability; insider trading by staff who hold material non-public information; conflicts where the firm advises both sides or has a financing relationship with a party; overstated projections or model errors; misdirected emails and unsecured file sharing; hidden legal or environmental liabilities in data rooms; payment diversion fraud; and fatigue or road accidents during overnight travel. At target sites, hazards include slips and falls, moving machinery, chemical storage, confined spaces, working at height, and unfamiliar electrical systems.

Risk is rated on a simple three-level scale based on likelihood and severity. High risk includes any exposure of material non-public information, any unmanaged conflict, and any site visit involving plant, chemicals, heights, or confined spaces. Medium risk includes model version errors and missed document deadlines that could cause incorrect terms. Low risk includes minor scheduling issues. The deal team records its assessment before kickoff and updates it at each milestone and after any change in structure, bidder list, or timetable.

• Must: rate every deal as high, medium, or low risk at kickoff and record the rating in the deal file.
• Must: treat any site visit involving machinery, chemicals, heights, or confined spaces as high risk, and do not enter operating areas without the site operator's induction and escort.
• Should: review the risk assessment after each major change, such as a new bidder or revised price.

4Preventive Controls and Safe Working Practices

Information barriers, often called ethical walls, separate deal teams from business areas that do not need access. Project folders use named permissions, and every access request is logged and approved by the deal leader. Deal conversations must not take place in public areas, open plan spaces, lifts, or on speakerphone where others can hear. Sensitive printing is restricted to secure printers with badge release, and drafts carry the code name rather than the target name.

Working practices also reduce personal harm. Travel for closings and site visits must include rest periods, a named check-in contact, and a rule that no one drives after prolonged duty without a break. Long working sessions need scheduled breaks. If a team member works beyond agreed hours for several consecutive days, the deal leader must redistribute work. Staff must not sign documents, certify figures, or give fairness views beyond their delegated authority. Site visits follow the written access plan agreed with the target, and no one leaves the agreed route.

• Must: use code names for targets in emails, calendar entries, and chat channels.
• Must: obtain compliance clearance before trading in any security connected to a live deal or passing any market-sensitive information to another person.
• Must: verify every payment instruction or bank account change by calling a known number, and treat unexpected changes as possible fraud.
• Must: do not release valuation outputs without a second reviewer and documented sign off.
• Should: report fatigue that affects driving or judgment to the deal leader, and stop travel until rested.
• Should: wear the protective equipment required by the site operator, such as safety footwear, high visibility clothing, or eye protection.

5Information, Equipment, and Environmental Safeguards

The main equipment in this work is laptops, mobile phones, secure document platforms, and video conferencing tools. Devices must use full disk encryption and multi-factor authentication. Lost or stolen devices must be reported immediately so access can be revoked. Personal devices and personal messaging applications must not carry deal information unless the firm has approved a managed solution. Removable media is prohibited for deal files unless the information technology team has approved it in writing.

Data rooms must use access logs, watermarking, view-only settings for sensitive files, and link expiry dates. Personal data in employee, customer, or pension records must be minimized and handled under the applicable data protection laws, which vary by jurisdiction and must be confirmed with counsel. Physical controls include clean desks during deal periods, locked storage for printed material, and secure shredding. Advisers must not enter zones where protective equipment is required unless they have it and have been instructed on its use.

• Must: enable multi-factor authentication and full disk encryption on every device used for deal work.
• Must: do not forward deal documents to personal email accounts.
• Should: revoke data room access as soon as a bidder leaves the process.
• Should: keep printed drafts in locked storage and shred them in approved bins.

6Incident, Emergency, and Escalation Procedures

An incident includes a suspected leak, a misdirected email, a lost device, an unexpected trading request, a figure that reached a client in error, a conflict discovered mid-deal, a payment fraud attempt, an injury on a site visit, or a road accident during travel. The person who discovers an incident must stop the activity that caused it, preserve evidence such as emails and access logs, and notify the deal leader and compliance officer on the same working day. Near misses, such as an email stopped before sending, must also be reported so patterns can be identified and corrected.

For injuries or medical emergencies, staff must call local emergency services first and then follow the site operator's emergency instructions. Advisers must not give medical treatment beyond their training and must not move an injured person unless there is immediate danger. Each site visit must confirm the location of first aid kits, emergency exits, and assembly points. Compliance decides whether regulators, counterparties, or insurers must be notified, and the timing of such notices must be verified with counsel.

• Must: call local emergency services for any injury needing urgent care, then notify the site contact and the firm's designated safety lead.
• Must: do not contact recipients of a leaked file on your own initiative; follow legal guidance.
• Should: maintain a written escalation list with names and out-of-hours numbers for each live deal.

7Records, Training, Monitoring, and Review

Each deal file must contain the confidentiality log, conflict clearance, risk assessment, access list, travel and site visit plans, and sign off records for key figures. Records must be kept for the period required by firm policy and applicable rules, which vary by jurisdiction and must be confirmed. Entries should be accurate and dated when created, and approved documents must not be edited without a version note.

Training is mandatory before anyone joins a live deal and must be repeated at intervals set by the compliance function. Training covers confidentiality, insider trading, conflicts, data protection, phishing, payment fraud, and incident reporting. The compliance and safety leads periodically review incidents, near misses, audit findings, and staff feedback, and they update these norms accordingly. Changes are communicated in writing and acknowledged by each team member.

• Must: complete confidentiality and securities training before receiving deal information.
• Must: complete the deal file before closing the matter.
• Should: run a tabletop exercise for a leak or payment fraud scenario before each team's first live deal.

8Using These Norms Locally

These norms are a starting point, not a complete legal or professional standard. Each firm must adapt them to its jurisdictions, regulators, and client base, and must have qualified counsel and compliance professionals confirm the current laws, regulator rules, and professional standards that apply. Where a local rule is stricter than this document, the stricter rule governs.

Implementation checklist

• Confirm conflict clearance and engagement authorization before opening any deal file.
• Assign a code name to each deal and use it in all communications.
• Verify every payment instruction or bank change by calling a known number.
• Rate the deal risk at kickoff and update the assessment at each milestone.
• Confirm that every device has encryption and multi-factor authentication.
• Report incidents and near misses to the deal leader and compliance officer the same day.
• Confirm training is complete before granting access to deal information.
• Obtain a second reviewer sign off before releasing any valuation figures.