To prepare for a meeting, exam, or inquiry with a regulator, put the agency's letter or exam notice, the topics you expect, the policies and public statements that cover those topics, the internal documents behind them, and the roles of the people who will attend into one request. Then instruct Pingpong to play the agency staffer across three rounds: the opening questions, the documents they would request, and the follow-ups they would ask when your answers and documents disagree. Ask which answers would hold up, which documents you cannot yet produce, and what counsel and compliance need to resolve before the meeting. Pingpong rehearses the conversation. Counsel and compliance decide what the company says.
This page is for chief executives, general counsel, compliance leads, and the executives who will sit across the table from agency staff. If the agency is reviewing a written submission instead, start with war-game a regulatory filing before it reaches the examiner. Executive starting points live under Pingpong for executives.
Three rounds of the role-play
Round one: the opening questions. Staff usually start broad. How does the product work? Who owns this area? When did the practice start, and has it changed? Each executive should give the same answer.
Round two: the document requests. Expect requests for the policy in force at each point in time, earlier versions of customer-facing screens, vendor contracts, internal audit reports, and board or committee materials on the topic. A good role-play lists each request and whether you can produce it today.
Round three: the inconsistencies. The hardest questions come where a public statement, a policy, a contract, and an internal email describe the same practice differently. The role-play should find those before staff do.
A worked example
This example is illustrative and does not describe a customer. A 180-person consumer app company receives an inquiry letter from a privacy regulator after a news story about how apps share location data. Agency staff have asked for a meeting in three weeks. The chief technology officer, the general counsel, and the head of privacy will attend.
The general counsel pastes the inquiry letter, the current privacy policy, the data sharing section of three vendor contracts, the consent screen history, the data retention policy, and a summary of what the risk committee was told last quarter.
In round one, the role-play shows that the chief technology officer's prep notes describe location collection as "only while the app is open," while the head of privacy's notes describe a background setting that some users enable. In round two, it lists the documents staff would likely ask for. The company cannot produce screenshots of the consent screen used before a redesign in the spring, and nobody owns the data map.
Round three finds the sharpest problems. The privacy policy says precise location goes only to service providers, while one vendor contract gives an advertising measurement partner access to precise location for attribution. The retention policy promises deletion within 30 days, but the data warehouse keeps backups for 13 months. The risk committee summary says there are no material privacy issues.
The team acts on the findings over the next three weeks. Counsel decides how to present the vendor arrangement and the retention gap, and whether any correction belongs in the policy before the meeting. Engineering rebuilds the earlier consent screen from source control and dates it. The head of privacy takes ownership of the data map. The three attendees agree on who answers which topics and rehearse the hard questions together. The risk committee chair receives a short briefing on the inquiry and the gaps found.
A request you can copy
Below are a regulator's inquiry letter, the topics we expect, our policies and public statements on those topics, the internal documents behind them, and the roles who will attend. Play the agency staffer in three rounds. First, the opening questions. Second, the documents you would request, noting which we appear unable to produce. Third, follow-ups wherever our statements, policies, contracts, and internal notes disagree. Do not give legal advice. Mark each issue for our counsel or compliance team, and list what our board or risk committee should hear before the meeting.
How Pingpong runs the role-play
The web review app sends your request through several models in order. Each later model receives the original request and every earlier answer, with instructions to assess the work so far. Ask counsel what you may paste before sharing privileged or confidential material. For the steps inside the app, see running your first review.
What a model can't role-play
A model does not know this agency's current priorities, what other companies have told it, or how these staff run their meetings. It cannot tell you what you are legally required to say or produce. Use it to rehearse and to find gaps, and let counsel and compliance lead every answer.
If the inquiry needs a board decision, see war-game a decision before the board meeting. More guides live under work decisions before you commit.