The letter usually arrives at the worst possible time. A regulator asks for documents, management starts forwarding emails, and someone …