SEC Exam Staff Issues Risk Alert on Investment Adviser Annual Compliance Reviews

On September 14, 2026, the staff of the US Securities and Exchange Commission’s (“SEC” or “Commission”) Division of Examinations (the “Division”) issued a Risk Alert (the “Risk Alert”) setting out their examination observations of SEC-registered investment advisers’ (“RIAs”) annual compliance reviews, as required by Rule 206(4)-7 (the “Compliance Rule”) under the Investment Advisers Act of 1940 (the “Advisers Act”). The Compliance Rule requires RIAs to, among other things, adopt and implement written compliance policies and procedures (the “Compliance Program”), and review the Compliance Program annually for effectiveness as further described below. The staff’s observations address the timeliness and completeness of those reviews, the consistency of the reviews with the RIAs’ written procedures, whether the reviews evaluated if the RIA’s current Compliance Programs continue to align with firm business practices and risks, proper retention of any documentation used in the reviews for books and records purposes, and the resolution of compliance matters identified during the reviews. The Risk Alert provides a useful indication of the particular areas examiners are likely to probe and underlines the SEC’s stated 2026 exam priority of focusing on the effectiveness of RIAs’ Compliance Programs.

The Annual Review Requirement

The Compliance Rule requires RIAs to review, no less frequently than annually, both the adequacy of their Compliance Programs and the effectiveness with which those Compliance Programs have been implemented. The adopting release to the Compliance Rule stated that these annual assessments should take account of compliance matters arising during the preceding year, developments in the business activities of the RIA and its affiliates, and changes in the Advisers Act and the rules thereunder that may warrant revisions to the Compliance Program. The Compliance Rule Adopting Release also stated that RIAs are also expected to consider whether interim reviews would be appropriate in response to significant compliance events, changes in business arrangements or regulatory developments. To the extent that RIAs create or use certain documents or other records in connection with the annual compliance review, Rule 204-2 under the Advisers Act (the “Recordkeeping Rule”) separately requires RIAs to keep and maintain such records in a true, accurate and current manner.¹

Exam Observations

Timeliness of annual reviews: Division staff identified RIAs that had not reviewed their Compliance Programs at least annually to determine their adequacy and the effectiveness of their implementation, including RIAs that:

• Omitted reviews in certain years, notwithstanding the requirement that reviews be conducted no less frequently than annually;
• Conducted reviews covering periods longer than 12 months, including first reviews performed 18 months after registration with the SEC. The 18-month period contemplated in the Compliance Rule’s adopting release was only available to RIAs following the rule’s October 5, 2004 effective date; since then, all reviews must be conducted at least annually, even for newly registered advisers. Other RIAs were observed conducting their annual reviews after extended intervals attributable to business, operational or personnel changes such as departures of the chief compliance officer (“CCO”);
• Took the position, in place of conducting any review, that delivering compliance trainings or collecting annual attestations of personnel’s adherence to the RIAs’ Compliance Programs discharged the annual review obligation. According to the staff, neither measure assesses the adequacy of the Compliance Programs or the effectiveness of their implementation, as the Compliance Rule requires; and
• Had received deficiency letters in prior exams for failing to conduct annual reviews, or to conduct them in a timely manner, and had nonetheless failed to remediate.

Sufficiency of review procedures: A number of the RIAs examined had committed themselves in writing to an annual review without establishing how one was to be performed, leaving personnel with no guidance on how to conduct the annual review. Examples included:

• Policies calling for the review to be documented and to incorporate testing and validation, yet leaving unstated the steps personnel were to take in carrying that testing out, the considerations governing a conclusion that the policies were adequate and effectively implemented, and the kind and volume of supporting records to be generated and preserved; and
• Policies identifying particular practices, services or operations for annual assessment in one part of the Compliance Program without carrying them over to the provisions governing the annual review. Topics designated for testing were accordingly passed over during annual reviews—for example, in one case, an RIA’s identity theft program, which its policies required to be tested each year, was not included in the annual reviews of the Compliance Program.

Adherence to written procedures: Division staff observed RIAs that conducted timely annual reviews but that were not carried out in a manner consistent with their written procedures, including reviews that:

• Did not follow the RIAs’ own policies and procedures requiring it to cover a defined review period or scope, to use specified work papers or other documentation, and to perform particular tasks and tests; and
• Assessed the effectiveness of incorrect documents, such as versions of the RIAs’ policies and procedures that had been updated and superseded before the review period, with the result that the assessment did not address the policies and procedures actually in effect.

Alignment of policies and procedures with practice: In designing a Compliance Program, an RIA must first identify the conflicts and other compliance factors creating risk exposure for the firm and its clients in light of its particular operations, and then design policies and procedures addressing those risks. Division staff observed RIAs that did not recognize, in the course of their annual reviews, that their Compliance Programs did not fully address, or were not aligned with, their business practices and the risks arising therefrom—whether because the RIAs had not adopted policies addressing risk areas pivotal to their businesses, or because they had not taken account of changes in their business activities relevant to the Compliance Program. The staff often identified these inconsistencies by comparing issues observed in core areas of an RIA’s business, operations and services against its annual reviews and applicable written policies. Examples included annual reviews that did not identify:

• Billing practices inconsistent with the RIA’s policies and procedures or with its client disclosures in advisory agreements and Form ADV, including fees calculated on a different basis than disclosed, fees not prorated for large deposits made mid-billing period, unapplied fee breakpoints, and refunds not issued on terminating accounts;
• Proxy voting policies committing the RIA to vote proxies for portfolio securities in its clients’ best economic interests, maintained by RIAs that had told clients they did not vote proxies on their behalf and did not do so in practice;
• Custody procedures that did not identify client accounts in scope of required surprise custody audits to the independent public accountants performing those audits;
• Marketing procedures still drafted to the advertising and cash solicitation rules that the Advisers Act marketing rule consolidated and replaced, compliance with which has been required since November 4, 2022;²
• Regulatory filing procedures not updated to reflect that RIAs with retail clients must file a Client Relationship Summary (Form CRS)³ with the SEC;
• Policies under which the RIA delegated services or operations to others without addressing how the RIA would oversee such delegation to prevent violations of the Advisers Act and the rules thereunder, as required under the Advisers Act;⁴ and
• Instances of non-compliance that were reported during the review period, but were neither addressed in the annual review nor recorded in it as such.

Documentation and retention: Division staff observed RIAs that created documentation when conducting their annual reviews, such as when performing testing and recommending corrective actions, but did not maintain such documentation in their books and records in accordance with the Recordkeeping Rule. According to the Compliance Rule Adopting Release, maintaining such records serve a practical purpose in that they help identify weaknesses in a Compliance Program where violations occur or are uncorrected. Examples included RIAs that:

• Discussed in their written annual review reports the compliance violations identified during the review, but did not retain the material generated in addressing those issues, such as records of the testing performed, the issues identified and the corrective actions recommended;
• Committed themselves by policy to memorializing the annual review in a written report covering specified topics—recommendations for improvement, material changes to be made to the policies and procedures, and material compliance issues requiring remedial action during the preceding year—but prepared no report at all; and
• Specified in their policies the form the documentation was to take, whether a series of checklists, work papers or templates, and then met those requirements only in part or not at all.

Resolution of identified matters: Division staff observed RIAs that did not take corrective action after their annual reviews recommended changes to their firm’s compliance policies or procedures, disclosures, and/or business practices. Examples included:

• Recommendations left unimplemented, among them improving disclosure of the RIA’s proxy voting practices, documenting client risk tolerances, and undertaking a more thorough analysis of best execution and third-party due diligence on broker-dealers; and
• Written review reports stating that corrective action had already been taken where the matters identified in the earlier review in fact remained outstanding.

Conclusion

Although many of the Division’s observations could be considered low-hanging fruit, they nevertheless provide a useful indication of areas that Division staff would likely focus on when evaluating the RIA’s annual compliance reviews during an examination.

RIAs should consider confirming that:

• Annual reviews of their Compliance Programs have been conducted for each year within a 12-month cycle;
• Their procedures specify the testing to be performed, the criteria governing their judgment of the adequacy and effectiveness of their Compliance Programs, and the documentation to be retained;
• Reviews are in fact being conducted as the RIAs’ procedures provide and compared against the policies currently in force;
• The scope of the annual reviews reflect both the Compliance Programs and the RIAs’ businesses as presently conducted;
• The materials generated in the course of the annual reviews are properly retained; and
• Compliance recommendations from prior annual reviews have been implemented.

In assessing their annual review processes, RIAs should consider making changes, where necessary, to strengthen their compliance and risk management systems, including to manage risks not described in the Risk Alert. The Division observes in the Risk Alert that the adequacy of supervisory, compliance and other risk management systems can be evaluated only by reference to the profile and circumstances of the particular firm, and encourages RIAs to consider the appropriateness of their annual review processes within that context.

¹ Advisers Act Rule 204-2(a)(17)(ii) (stating that every adviser “shall make and keep true, accurate and current the … books and records relating to its investment advisory business [including] … any records documenting the investment adviser's annual review of [its] policies and procedures”).  

² The marketing rule was adopted in SEC, Final Rule: Investment Adviser Marketing, Advisers Act Rel. No. 5653 (Dec. 22, 2020), which consolidated the former advertising and cash solicitation rules into a single rule. RIAs have been required to comply since November 4, 2022. The Division has reported exam findings under the rule on two prior occasions. See Risk Alert: Initial Observations Regarding Advisers Act Marketing Rule Compliance (Apr. 17, 2024); Risk Alert: Additional Observations Regarding Advisers' Compliance with the Advisers Act Marketing Rule (Dec. 16, 2025).

³ Form CRS informs retail investors of, among other things, the firm’s relationships and services, the associated fees, costs, conflicts of interest and required standard of conduct, and any reportable legal or disciplinary history.

⁴ RIA should select and monitor such delegation (and any service providers) with reasonable care consistent with its fiduciary duties to the client. In 2022, the SEC had proposed a rule that would have imposed particular oversight requirements for certain services outsourced by RIAs, but later withdrew that proposed rule in 2025. See our Legal Update on that withdrawal, SEC and CFTC Extend Compliance Date for Form PF Amendments and SEC Withdraws Certain Proposed Rules.