On a gray Tuesday morning, the audit seemed routine. A stack of binders sat on the table, the compliance officer was confident, and the regulator’s tone was cordial. Then came the question that ...