The reconstruction test for estate-planning records

When a question surfaces about a household’s estate-planning documents, it gets answered from records, not from memory. Advisors preparing to offer estate planning tend to focus on the conversation: what can and cannot be said. The question about a completed household arrives years after the engagement, from a compliance examiner, a state bar, or the lawyer for a beneficiary who expected more, and nobody replays a conversation. What survives is the file. Advisory firms already run on this rule everywhere else: SEC Rule 204-2 enumerates the books and records a registered investment adviser must keep, examinations are conducted against those records, and broker-dealers carry a parallel obligation under FINRA Rule 4511. Estate-planning coordination is usually the newest service line in a practice, and usually the only one documented informally.

The reconstruction test

The test takes twenty minutes. Pick any household whose plan is complete and produce four records without calling anyone.

Most practices fail the test at question two.

On the first question, most firms can show an engagement letter and a calendar full of meetings. Neither names the person who made the selection. Question two is where the file stops entirely, because a client clicking through a screen was unremarkable on the day it happened, so nothing captured it, and the moment is gone.

What the request looks like

A household completes a trust-based plan. Some years later the grantor dies. One adult child receives less than expected, hires a lawyer, and the lawyer sends the firm a preservation letter followed by a document request: all correspondence, drafts, the executed documents, and any record of how the documents were selected, with a date range and an instruction that nothing be deleted.

The executed documents are easy. The correspondence is an email export, including every scheduling message and whatever a colleague wrote in a hurry three years ago. The selection record shows whether the household chose its own plan, and it is the part of the request most firms cannot fill.

A firm with system-generated records answers the request in an afternoon: selection events with timestamps and the client as the named actor, the consent record for what was accepted and when, the review-queue entry for anything that was flagged. A firm without them spends weeks assembling an email archive and then has to explain it. Same facts, same conduct, and the cost differs by an order of magnitude. Examinations run against the same asymmetry: in its fiscal 2021 examination priorities, the SEC’s Division of Examinations reported having examined 15 percent of registered investment advisers in fiscal 2020, and an examination is answered the same way, from files.

Where the answers usually live

No firm decides to keep a bad record. The record accumulates wherever the work happened:

• Email threads. What the household decided arrives as a message and stays there, interleaved with scheduling, searchable only by whoever still works there. Reply-all forks the thread, and the fork is the copy nobody kept.
• A shared drive. Final versions overwrite drafts. A file named trust-FINAL-v3.pdf establishes nothing about what v2 said or when v3 replaced it.
• Somebody who was there. The associate who sat in on the meetings, the junior advisor who has since left. The most common answer to how a firm would reconstruct what happened, and the least durable one.
• A system nobody chose for this. A CRM note field, a task tool, a shared calendar. Records that exist as a by-product of something else and were never meant to be read back.

What a record has to establish

Actor attribution comes first. A log line reading "document created, actor: the firm" records that a document exists. A line reading "selection submitted, actor: the client" records the fact everything else depends on: the document-preparation framework rests on the client making the selections. The distinction is not new. In Janson v. LegalZoom, 802 F. Supp. 2d 1053 (W.D. Mo. 2011), a federal district court treated the sale of blank forms as lawful self-help and tested the questionnaire-driven branch on who exercised the judgment, and the 2015 LegalZoom consent judgment with the North Carolina State Bar made review of each template by a North Carolina-licensed attorney a term of LegalZoom’s own operation in the state.

Then sequence, with timestamps that come from the system rather than from a filename. Then immutability: a log that anyone can edit after the fact carries the weight of an undated memo, and a log whose alterations would be detectable carries considerably more. Then retention past the life of the engagement, because the request tends to arrive after the household has moved on, and often after somebody has died.

The same properties convert into questions a firm can put to any platform in writing, where the answers become records themselves:

• When a client makes a selection, is the client logged as the actor, or does the event record the firm?
• Can an administrator at the vendor edit or delete an audit record, and would anyone be able to tell if they had?
• What exactly is captured at the moment a client accepts terms: the version, the timestamp, the IP address?
• Can the firm export a household’s full audit history itself, without asking the vendor to produce it?

A vendor that has built these can describe them in a paragraph. A vendor that has not will describe an intention.

How Bancroft builds the record

Every action on a household writes to an append-only audit table with hash-chain integrity, so an altered record breaks the chain and is detectable. Events carry actor attribution: a client selection is logged as the client’s action, and a retention floor set in code keeps the records past the engagement. The full history for any household exports from the advisor’s own console, so the firm’s copy of the record does not depend on continued access to the platform.

Acceptance is captured as its own record. Every signup writes a consent event with the user, the timestamp, the IP address, the user agent, and the version of the terms that were on screen, and the same record is written again against the household’s own packet when the client accepts the generation disclaimer. Flags are queue entries rather than conversations: a red-flagged document routes for $299 attorney review with a reason code, and the resolution lands on the household record. Template integrity is enforced by content hashes over the locked clause and tree sources, checked automatically in CI, so an edit to a locked file cannot ship without an explicit, approved re-signing. The library-level review this protects is the subject of attorney-reviewed versus attorney-prepared; the encryption and access-control side is on the security page.

What the record does not do

A complete audit trail does not make conduct lawful, and it confers no protection or indemnity. Where a selection was not the household’s, a thorough log records that plainly, and the plain record serves the firm worse than a vague one would have. The record is neutral as to whom it helps.

There is also no public data on how often advisor estate-planning coordination draws a bar inquiry or a beneficiary dispute; bar proceedings are largely confidential, and nobody publishes denominators. The case for the record is cost rather than probability: a record either accumulates as the work happens or it does not exist, and no amount of diligence afterwards produces one.

Run the test on one completed household this week. A clean result costs twenty minutes and confirms the file answers for itself. An email-search result cannot be fixed after the fact for the households already on the books. The next household’s record can be set up right from intake.