Auditing a Pricing Algorithm for Antitrust Risk: A Practical Guide

Document type: Guide Practice area: Antitrust — Price Fixing and Cartels Jurisdiction: United States Last reviewed: 5 September 2026

Why the audit is worth running now

Two facts make this a good use of time.

First, the exposure is asymmetric. A per se price-fixing finding carries treble damages, criminal risk, and joint and several liability with no contribution. The audit costs a few weeks of professional time.

Second, the evidence that will decide any future case already exists. The vendor's sales deck is in somebody's inbox. The email saying the tool works only if competitors use it was written three years ago. Adherence rates are being logged whether or not anyone reads them. The audit does not create this material; it finds it while the firm can still do something about it.

The audit is also, in a real sense, a product review. Most firms discover that they are contributing more data than they realized, receiving less individualized output than they assumed, and paying for features they would not have bought had anyone asked the questions below.

Step one: scope it and protect it

Scope. List every pricing tool in use, including ones the legal department has never heard of. Ask procurement for every contract with a term containing "pricing," "revenue management," "yield," "rate," "benchmark," or "market data." Ask the data team what external feeds exist. Ask the commercial teams in each business unit directly, because shadow tools are common and a departmental subscription to a market data product is exactly the sort of thing that never reaches legal.

Privilege. Run the audit at the direction of counsel, for the purpose of providing legal advice. Document that purpose in a written engagement or memorandum at the outset. Use counsel to direct any consultant or economist, engage them through counsel, and mark work product accordingly.

Be realistic about the limits. Business documents do not become privileged by being sent to a lawyer. Data about what the model does is not privileged. Vendor contracts are not privileged. What can be protected is counsel's analysis and the communications made to obtain it — which is precisely why the audit's findings should live in a legal memorandum and not in a slide deck circulated to the commercial team.

Sequence. Do the document work before the interviews. People remember more accurately when shown a document, and you want to know what the file says before you ask anyone what happened.

Step two: classify the architecture

Sort every tool into one of four categories, because the risk profile differs by an order of magnitude:

Own-data optimization. Uses only the firm's own data. No antitrust issue.
Public-data monitoring. Incorporates publicly posted competitor prices. Low risk; check data provenance and terms of use.
Pooled non-public data. Competitors contribute confidential data to a vendor that aggregates and returns output. This is where the risk concentrates.
Delegated pricing. Prices are set by the vendor or adopted automatically without review. Highest risk; may support per se characterization.

Do not accept the vendor's characterization or the business team's belief. Determine the answer from the data flows and the contract.

Step three: map data provenance

For each tool, build a table with one row per data element:

The rows that need attention:

Anything non-public, from a third party. Where did the vendor get it? From competitors? Under what terms?
Anything a salesperson reported. From a customer (ordinary market intelligence) or from a competitor's employee (an inter-firm communication that does not become lawful by being entered into a database)?
Anything scraped. From public pages, or from behind a login? Terms of use, and computer access considerations, both matter.
Anything from a shared consultant, trade association, or joint venture. These are classic conduits.
Anything forward-looking. Future prices, planned capacity, forward bookings. Forward-looking competitor data is the most dangerous category in any exchange.

The provenance map is the single most useful artifact the audit produces. It answers the question every regulator asks first.

Step four: understand the pooling

If the tool uses pooled data, get answers to these, in writing, from the vendor:

How many participants contribute in each relevant market?
What share of the market do they represent, individually and in aggregate?
What data do they contribute, and how current is it?
Is the output aggregated or firm-specific?
Can a participant identify another participant's data from the output, directly or by inference in a thin market?
Is the product available to any industry participant on the same terms?
Does the vendor disclose participation, adherence rates, or competitor identities to any subscriber?

Measure the answers against the information-exchange safeguards: historical rather than current data, aggregation sufficient to prevent identification, enough participants that no one dominates the aggregate, administration by an independent third party, availability on non-discriminatory terms, and no accompanying discussion of pricing intentions.

A tool that satisfies these looks like benchmarking. A tool that fails several of them looks like a mechanism.

Step five: read the contract

Contract terms that need to be found and assessed:

Data contribution obligations. What must the firm supply, and at what frequency?
Data use rights. May the vendor use the firm's data in products sold to competitors? Almost always yes, and almost always unread.
Adherence provisions. Any requirement, target, or incentive to accept recommendations.
Fee structure. Success fees tied to market-level metrics such as market RevPAR or category price index are a serious problem; fees tied to the firm's own performance are not.
Vendor monitoring. Rights to review declined recommendations, report on acceptance rates, or escalate deviation.
Participation disclosure. Does the vendor tell the firm who else uses the product?
User groups and advisory boards. Any obligation or expectation to participate.
Audit and information rights the firm has over the vendor.
Termination, and what happens to the firm's contributed data.
Indemnity. Does the vendor indemnify for antitrust claims arising from the product's design? Usually not, and this is worth raising at renewal.

Step six: review the documents

Search the file with specific queries rather than general ones. The phrases that matter are surprisingly consistent across industries:

"only works if" / "everyone uses" / "market discipline" / "rational pricing" / "stop the race to the bottom"
"the whole market" / "industry-wide" / "if others adopt"
"acceptance rate" / "compliance rate" / "override" / "declined recommendation"
competitor names near "price," "rate," or "increase"
vendor name near "competitors," "penetration," "market share of users"

Review, at minimum: the vendor's sales and implementation materials; internal approval memoranda and business cases for the purchase; board and executive presentations; account management correspondence; user group agendas, materials, and attendee lists; and internal pricing discussions for the periods around significant price movements.

The business case is often the most revealing document in the set, because it was written to persuade and therefore states the theory of value plainly. If the theory of value was market-wide price improvement, it will say so.

Step seven: interview the people

Interviews after documents, and with counsel present.

The pricing team. What do you do with a recommendation? Do you override it? When did you last, and why? Does anyone ask you why you overrode it? Do you know which competitors use this tool? Has anyone from the vendor discussed what competitors do?

The revenue or category leadership. What did you expect this tool to accomplish? How is your team measured? Is acceptance rate a metric?

The data team. What exactly do we send? At what frequency? What comes back? Could we identify a competitor's data from the output?

Procurement. What alternatives were considered? What did the vendors say about market coverage?

Anyone who attended a user group. What was discussed? Were competitors present? Did anyone talk about pricing intentions, and what did you do?

That last question matters more than it sounds. A person who was in a room where a competitor discussed future pricing, and who stayed and said nothing, has created a problem — in the United States as a matter of evidence, and in Europe as a matter of presumption.

Step eight: analyse adherence and deviation

Pull the data. For each period:

Recommendations received, and how many were adopted, modified, or rejected.
Adherence rate over time. A rate that climbed steadily after implementation is a normal adoption curve. A rate that jumped to near-total after a vendor intervention is not.
Deviations, with the direction and magnitude. Downward deviations — pricing below the recommendation — are the most valuable evidence of independence.
What happened after a deviation. Any vendor contact? Any internal escalation?
Whether the decision was documented, and by whom.

Then run the counterfactual: what did pricing look like before adoption, and what changed? Do this with an economist engaged through counsel, because the answer will either be reassuring or will need to be understood before anyone else computes it.

Step nine: assess the vendor's conduct

The firm may be exposed to what its vendor did, and the vendor's marketing is discoverable and will be attributed to the scheme the firm is alleged to have joined.

Collect and assess: every sales deck and one-pager received; recorded demonstrations and webinars; the vendor's public marketing and case studies; user conference materials; and any statement about market penetration, adherence, or market-wide pricing effects.

If the vendor has made such statements, the firm has three options, and should choose one deliberately: obtain written confirmation from the vendor that the product does not operate in the manner described and that the statements were inaccurate; renegotiate the contract to remove the features that make the statements plausible; or exit.

Doing nothing, having read the deck, is the worst of the four options — and is the one most firms choose by default.

Step ten: remediate

Remediation falls into four buckets.

Contract. At renewal, or sooner: remove adherence targets and market-level success fees; prohibit the vendor from disclosing participation or adherence data to the firm; limit the firm's data contribution to historical, aggregated elements; obtain a warranty that output is individualized to the firm's own circumstances; add an audit right; and seek indemnity for antitrust claims arising from product design.

Configuration. Turn off features that create risk: automatic price adoption; competitor-identifiable displays; forward-looking competitor data feeds; market-level dashboards showing competitor behaviour. Many of these are switchable and nobody has ever asked.

Process. Require documented human review of recommendations, with a stated reason keyed to the firm's own circumstances — inventory, cost, capacity, customer relationship, strategic objective. This is the cheapest and most valuable single control in the whole programme.

People. Train the pricing, revenue, and sales teams. The training must cover what may be collected about competitors and from whom; what to do when a competitor volunteers pricing information (leave, object, document, report); that recommendations are inputs, not instructions; and that the sentence "this works only if everyone uses it" must never be written or said, because it is both wrong and fatal.

Step eleven: document the audit and report it

Produce a legal memorandum covering: tools identified and classified; data provenance; pooling characteristics measured against the safeguards; contract terms of concern; document findings; interview findings; adherence analysis; risk assessment by tool; and remediation, with owners and dates.

Report to the audit committee or board at a level of detail appropriate to the finding. If the audit found nothing serious, the report is short and the value is the record that the firm looked. If it found something serious, the report should be delivered by counsel, in person, with a recommendation.

Set a re-audit cadence: annually for pooled-data tools, on any change of vendor or material change of product, and on any acquisition that brings a new pricing tool into the group.

Step twelve: if the audit finds something serious

Occasionally an audit finds an actual problem: an executive who discussed pricing with a competitor at a user group; a vendor that promised market-wide discipline and delivered it; an internal instruction never to price below the recommendation.

The immediate steps:

Stop the conduct. Immediately, and document that it stopped.

Preserve. Issue a litigation hold covering the relevant custodians and systems.

Investigate properly. The audit becomes an investigation, conducted by counsel, with a defined scope and an eye to the possibility that it will be described to a regulator.

Assess leniency. Corporate leniency programmes for criminal antitrust exposure reward the first firm in the door and reward nobody else. That calculus has to be made quickly, with specialist advice, and by people who understand that the window can close without warning when another participant moves first.

Consider the civil exposure separately: class actions, indirect purchaser claims under state statutes, opt-out claims by large customers, and follow-on proceedings abroad.

Fix the programme, and be able to show what was fixed and when. Remediation matters to enforcers and to sentencing.

A closer look at data provenance, because this is where audits fail

The provenance map sounds like an administrative exercise. It is the substantive core of the audit, and it is where a superficial review misses the problem.

The failure mode is straightforward: the audit asks the data team what feeds the model, the data team names the systems, and everyone moves on. Nobody asks where the systems got the data. Three layers down, a field called competitor_price_observed is populated by a nightly job that pulls from a CRM field a salesperson filled in, and nobody has ever asked what the salesperson was told or by whom.

Run the map to the original human or public source, every time. The questions that surface problems:

For every field containing anything about a competitor:

Who first recorded this value, and what were they looking at?
If a person entered it, what were they told and by whom?
If it was scraped, from what page, and was authentication required?
If it came from a vendor, where did the vendor get it?
If it came from a customer, was it volunteered or solicited, and was the customer under any obligation of confidence to the competitor?

For every third-party feed:

What is the contractual description of the data, and does it match what actually arrives?
Does the provider aggregate, and to what level?
Could the firm reconstruct a specific competitor's values from the feed?

For every internal system that touches pricing:

Does it retain competitor data, and for how long?
Who can see it?
Is it flagged as competitor-sourced anywhere, so that a later reviewer would know?

The last question is worth dwelling on. A pricing database that mixes own-transaction data, public list prices, customer-reported competitor bids, and salesperson-collected competitor intelligence in undifferentiated columns cannot be defended, because nobody can say what the model relied on. Tagging every competitor-derived field with its provenance category at the point of entry costs a schema change and makes the whole system explicable. Firms that have done it find the tagging useful for reasons having nothing to do with antitrust — data quality improves when people have to say where a number came from.

Customer information and the intelligence that is fine to have

A recurring anxiety in these audits is that the sales force will be told to stop gathering market intelligence, which would be both impractical and unnecessary.

The line is about the source, not the content.

Lawful, and ordinary:

A customer says a competitor quoted a lower price. This is the customer's information, volunteered in a negotiation, and using it is competition working as intended.
A competitor's published price list, website price, shelf price, or public bid result.
A competitor's public statements: earnings calls, press releases, filings, trade press interviews.
Aggregate market data from a properly constructed benchmarking product.
A former employee's general skill and experience, subject to their confidentiality obligations.

Not lawful, or dangerous:

A competitor's employee tells your employee what the competitor will charge.
A shared distributor, consultant, or trade association staffer passes along competitor-specific confidential data.
A customer passes along a competitor's confidential document it was given under an obligation of confidence — the customer's breach does not become your right.
Reciprocal information sharing, even indirect, even through a third party.
Anything obtained by misrepresentation.

The training message is short enough to remember: you may learn anything the market tells you, and nothing a competitor tells you.

And there is a procedure for the awkward case, which arises more often than firms expect. A competitor's representative, at a conference or on a customer call, starts describing pricing plans. The employee should: say clearly that they cannot discuss this, leave the conversation or the room, note what happened and when, and report it to legal the same day. In Europe, public distancing is what rebuts the presumption that the information was taken into account; in the United States, the contemporaneous note is what a defence lawyer will want years later. Both point to the same behaviour.

Testing the model, not just the paperwork

Some audits stop at documents and interviews. The stronger version tests the model's behaviour directly, which requires cooperation from the data team and, usually, an economist working under counsel's direction.

The tests worth running:

Sensitivity to competitor inputs. Hold the firm's own data constant and vary the competitor-derived inputs. How much does the recommendation move? If the recommendation is largely driven by the firm's own inventory and cost, that is a strong fact. If it tracks competitor prices almost one-to-one, that is a different fact and the firm should know it.

Individualization. Do two participants with different cost structures and inventory positions receive materially different recommendations? Ask the vendor to demonstrate this, and be sceptical of an answer that is not demonstrated.

Directionality. Does the model ever recommend a price decrease? A tool that recommends increases and holds but rarely cuts is behaving asymmetrically, and that asymmetry will be a central allegation if the case ever comes.

Response to a deviation. If a participant prices below the recommendation, what does the model do next period — for that participant and for others? A model that responds to undercutting by recommending that others hold rather than match is doing something that will be very hard to explain.

Historical replay. Run the model on the period before adoption. Would it have recommended what the firm actually did? A large divergence tells you the tool changed behaviour, and you want to understand how before someone else characterizes it.

Document these tests carefully and route the results through counsel. They can be extremely helpful facts. They can also be unhelpful facts, which is a reason to learn them early, when the firm can still change the product.

Worked example: a distributor's audit

Ngozi Adeyemi, general counsel at Fairbrook Supply, runs the audit across three business units.

Scoping finds four tools rather than the one she knew about: the enterprise revenue management platform, a market data subscription in the industrial unit, a freight rate benchmark in logistics, and a spreadsheet model one region built itself.

Classification puts the enterprise platform in category 3 (pooled non-public data), the market data subscription in category 3 as well (it turns out to include transaction-level data contributed by subscribers), the freight benchmark in category 2, and the spreadsheet in category 1 — until provenance mapping reveals that a column of the spreadsheet is populated from competitor quotes reported by sales representatives, some of which came from competitor employees at a trade show.

The pooling review on the enterprise platform is reassuring: eleven participants, none above 18%, data at a 90-day lag, output aggregated at the regional level rather than firm-specific. It looks like benchmarking because it is.

The market data subscription is not reassuring: four participants in the relevant segment, current-week transaction prices, and output that in a thin sub-segment is effectively attributable. Ngozi recommends terminating it.

Document review finds one problematic email, from a regional manager, saying that the market data product "keeps everyone honest on pricing." Ngozi assesses it as an unfortunate phrase from someone who did not know what he was saying rather than evidence of an agreement, but it goes on the list, the manager is retrained, and the product is going away regardless.

Remediation covers all four: terminate the market data subscription; keep the enterprise platform with contract amendments at renewal; leave the freight benchmark alone with a provenance note; and rebuild the regional spreadsheet without the competitor-quote column, with a new intake policy.

The report to the audit committee runs four pages. The committee asks one question — whether the enterprise platform should also go — and Ngozi explains why the safeguards make it different. That exchange, minuted, is itself part of the record that the firm took the question seriously.

Building the human review that actually works

The single most valuable control in an algorithmic pricing programme is documented human review, and most firms implement it badly.

Bad implementation looks like this: a checkbox in the pricing system labelled "reviewed," clicked by a revenue manager processing eighty recommendations before lunch. It creates a record that says nothing, costs real time, and is worse than useless in litigation because a plaintiff will characterize it as a rubber stamp — which it is.

Good implementation has four features.

A reason drawn from the firm's own circumstances. The reviewer selects or writes a basis: inventory position, cost change, capacity constraint, customer commitment, competitive bid situation, strategic objective, seasonal pattern. Note what is not on the list: "market conditions," "competitor pricing," or "vendor recommendation." A reason that points outward rather than inward is not evidence of independent judgment.

Proportionate depth. Not every recommendation deserves a paragraph. Tier the review: routine recommendations within a normal band get a one-click reason code; recommendations outside the band, or above a materiality threshold, get a written note; recommendations that would move price by more than a stated percentage get a second approver.

Genuine authority to decline. The reviewer must actually be able to reject the recommendation without explaining themselves to the vendor or facing a metric that punishes them. If the revenue manager's bonus is tied to acceptance rate, the review is theatre and everyone in the eventual deposition will know it.

Retention. Keep the reasons. They are the record, and they are only useful if they survive the system migration that will happen in three years.

Firms that implement this properly report an unexpected benefit: the reason codes are analytically valuable. Knowing why recommendations get rejected is exactly the feedback loop that improves a pricing model, and the pricing team stops seeing the control as a legal imposition.

Training that people remember

Antitrust training in this area fails when it is generic. A slide saying "do not fix prices" tells a revenue manager nothing they did not know and nothing they can act on.

Effective training for a pricing function is short, specific, and scenario-based:

Scenario one. At an industry conference, a competitor's regional manager says over coffee that "everyone needs to hold rates through the fourth quarter." What do you do? (Say clearly you cannot discuss it. Leave. Write it down. Tell legal today.)

Scenario two. A customer tells you a competitor bid $4.20. May you use it? (Yes. It is the customer's information, volunteered in a negotiation. Record where it came from.)

Scenario three. The vendor's account manager mentions that "most of the market is running at 94% acceptance." What is the problem? (You have just been told what competitors are doing with the same tool. That is exactly the assurance that turns a tool into a mechanism. Report it; ask the vendor to stop.)

Scenario four. You want to override a recommendation because you need to fill inventory this weekend. Should you? (Yes, if that is your judgment. Record the reason. Nobody outside the firm should ever ask you about it.)

Scenario five. You are writing a business case for a new pricing tool. What should the value proposition never say? (That it improves pricing across the market, or that it works better when competitors use it.)

Deliver it in twenty minutes, to the people who actually touch pricing, with their own product examples. Repeat annually. Keep attendance records — not because attendance proves anything, but because its absence is used against firms.

What the audit costs, and how long it takes

For planning purposes, a first audit at a mid-sized firm with two or three pricing tools:

Scoping and privilege setup: a few days.
Contract collection and review: one to two weeks, largely paralegal and associate time.
Data provenance mapping: the longest item, two to four weeks, and dependent entirely on the data team's availability. Budget more than you think.
Document review: one to three weeks, scoped to targeted custodians and search terms rather than a full collection.
Interviews: one week.
Adherence and model analysis: two to four weeks with an economist, run in parallel.
Report and remediation plan: one week.

Call it eight to twelve weeks elapsed, with the legal team's own effort concentrated in the first and last thirds. Subsequent annual audits are far shorter — the provenance map exists, the contracts are known, and the work is confirming what changed.

The largest single cost driver is the document review, and the way to control it is to be disciplined about custodians and search terms. Five custodians and fifteen well-chosen phrases will find what a hundred custodians and a keyword dump will bury.

Auditing an acquisition target

The audit has a second life in transactions, and it is increasingly a standard diligence workstream in industries where pricing tools are common.

In diligence, the questions are the same but the access is worse. What to ask for:

A list of all pricing, revenue management, and market data tools, with contracts.
The data provenance map, if one exists (usually it does not).
Any prior antitrust audit, investigation, CID, or subpoena.
Adherence data for the last three years.
Vendor marketing materials received.
Trade association memberships and any data exchange participation.
The target's antitrust compliance policy and training records.

What to look for in the answers. A target in a concentrated market using a pooled-data pricing tool with high penetration is a real diligence finding, and it should be priced. The exposure is not limited to the target's own liability: an acquirer takes on successor liability, and the target's conduct becomes the acquirer's problem for both civil and criminal purposes.

Deal protections. A specific antitrust representation covering pricing tools and information exchange; a special indemnity where the diligence raises a concern; escrow sized to the exposure; and, where the finding is serious enough, a pre-closing covenant requiring the target to terminate the arrangement.

Post-closing. Integrate the target's pricing tools into the acquirer's audit programme immediately, not at the next annual cycle. The most common way a clean firm acquires an antitrust problem is by acquiring a company whose pricing practices nobody examined.

There is also an antitrust dimension to the diligence itself. The acquirer and target are, until closing, independent competitors, and exchanging current pricing data during diligence is itself an information exchange. Use a clean team, aggregate and lag the data, and document the protocol. Gun-jumping allegations have arisen from diligence that was conducted carelessly, and the fact that the exchange happened in a data room does not make it lawful.

Reporting up without alarming everyone

A finding of real risk has to be communicated to people who are not antitrust lawyers, and how it is communicated determines whether anything gets fixed.

Lead with the specific fact, not the doctrine. "We contribute our current-week transaction prices to a pool that includes four of our six competitors, and we receive back a price recommendation for each product" lands. "There is a risk of a hub-and-spoke conspiracy claim under Section 1" does not.

Quantify the asymmetry. Treble damages, joint and several liability, criminal exposure, and the cost of defending even a case you win — against a remediation plan that costs a contract renegotiation and a process change.

Bring the recommendation, not the options. Executives asked to choose among four legal alternatives will choose the cheapest. Executives given a recommendation with a reason will usually take it.

Say what the firm keeps. The commercial team's fear is that legal will take away a tool that makes money. Most remediation preserves most of the value: the firm keeps the model, keeps the analytics, keeps the forecasting, and gives up the specific features — forward-looking competitor inputs, adherence monitoring, market-level dashboards — that provide the least commercial value and the most legal risk.

Put a date on it. A remediation plan without owners and dates is a memorandum. With them, it is a control.

Keeping the programme alive

An audit is a snapshot. The programme is what maintains the position between audits.

A gate on new tools. Any new pricing, market data, or benchmarking subscription requires legal review before purchase. Put it in the procurement workflow so it cannot be skipped, and keep the review light for category 1 and 2 tools so that the gate does not become an obstacle people route around.
A standing question at contract renewal. What changed in the product this year?
An annual provenance refresh. Data feeds change without anyone telling legal.
Quarterly adherence reporting to the compliance function, with a threshold that triggers a look.
A named owner in the pricing organization who is trained, knows to call, and is empowered to say no.
An open channel. The employee who was in the room when a competitor started talking about pricing needs to know exactly who to call, and needs to believe that calling is safe.

None of this is expensive. All of it is the difference between a firm that can explain its pricing programme and a firm that discovers what its pricing programme was doing at the same time as the plaintiffs.

Coordinating with the economist

Almost every serious algorithmic pricing matter ends up requiring an economist, and the audit is the cheapest time to engage one.

Engage through counsel, under a written engagement describing the purpose as assisting counsel in providing legal advice. Do not have the pricing team hire an economist directly and then send the report to legal.

Scope the first engagement narrowly. The initial questions are diagnostic, not litigation-grade: did prices change after adoption, and by how much; did the firm's price dispersion change; did the firm's responsiveness to its own demand and cost signals change; how does the firm's pricing pattern compare with market participants who do not use the tool, if any can be identified from public data.

Expect the answer to be complicated. Prices rose in most markets over most recent periods for reasons having nothing to do with pricing software — input costs, demand shifts, capacity constraints, and monetary conditions all move prices. An economist's first useful contribution is often to establish how much of an observed increase is explained by ordinary factors, which is exactly the analysis a defendant will eventually need.

Do not commission a report you would not want to read aloud. Diagnostic work under privilege is appropriate; commissioning a formal report before you know what it will say is not. Ask for oral findings first.

Keep the economist's data separate. The datasets an economist builds are discoverable in litigation if the economist testifies, and the boundary between consulting and testifying experts needs to be managed from the beginning rather than reconstructed later.

A closing thought on proportion

It is possible to over-lawyer this. A firm that responds to algorithmic pricing risk by refusing to use analytics, forbidding its sales force from noticing competitors, and requiring a legal memorandum before any price change has not managed risk; it has substituted a certain commercial cost for an uncertain legal one, usually at a bad exchange rate.

The proportionate position is clear enough. Own-data optimization needs nothing. Public-data monitoring needs a provenance policy. Pooled non-public data needs the full safeguard set, and often needs the pool restructured. Delegated pricing needs to be redesigned.

Most firms, on running the audit, find that they sit in the third category with one tool and the first or second with everything else — and that fixing the one tool takes a contract amendment and a configuration change. The audit's real value is that it tells the firm which category it is actually in, which is very often not the category it believed.