A request for information is not yet an enforcement action, and the way it is answered has a substantial influence on whether it becomes one. Two failure modes dominate: treating the request as an administrative task to be discharged as quickly as possible, and treating it as an attack to be resisted.
Scope the request before answering any of it
Read the request against the regulator's actual statutory power. Requests are frequently drafted broadly and are not always co-extensive with the authority behind them. Establishing scope politely, in writing, at the outset is normal practice and is not treated as obstruction.
Control the disclosure set
- Collect centrally; do not let individual departments respond directly.
- Review everything before it leaves the organisation.
- Identify privileged material and log it rather than producing it.
- Keep a complete record of exactly what was produced and when.
Answer the question that was asked
Volunteering context is rarely helpful and frequently opens new lines of enquiry. Answer precisely, accurately and completely within the scope agreed — and never inaccurately, which converts a compliance question into a credibility problem.
Run the internal review in parallel
If the request suggests the regulator has identified something real, find out what it is before they tell you. An organisation that has already identified an issue and begun remediation is in a materially different position from one that learns of it in an enforcement notice.
