SEC Division Of Examinations Publishes Risk Alert On Annual Compliance Reviews

On September 14, 2026, the U.S. Securities and Exchange Commission (the “SEC”)’s Division of Examinations (the “Division”) issued a Risk Alert detailing its observations of registered investment advisers (each an “Adviser” and collectively “Advisers”) related to issues regarding annual compliance reviews. The Division based its Risk Alert on examinations of Advisers’ annual compliance reviews and issued it to assist Advisers in conducting such reviews and implementing any resulting findings.

Background

Advisers must conduct an annual review under Rule 206(4)-7 of the Investment Advisers Act (the “Advisers Act”), also known as the Compliance Rule. The rule requires Advisers to review, at least annually, the adequacy of their compliance policies and procedures, as well as the effectiveness of their implementation. Such annual review conducted under the rule requires that Advisers take into account compliance matters from the prior year, changes in the Adviser’s or its affiliates’ business, and changes in the Advisers Act or applicable regulations. Advisers must also keep true, accurate, and current records regarding these reviews, while also addressing the need for any interim reviews as necessary.

Observed Areas of Deficiencies

The Division highlighted six areas where it observed deficiencies: timeliness of annual reviews; complete procedures for conducting reviews; reviews consistent with written procedures; policies aligned with actual practices; documentation and recordkeeping; and corrective action.

Details regarding each area are discussed more fully below.

Timeliness of Annual Reviews

According to the Division, some Advisers:

• Failed to perform reviews at least annually.
• Had review periods that were longer than 12 months, including delays tied to CCO departures and other business changes.
• Treated compliance training or personal attestations as a substitute for review.

The Division also identified recidivist conduct among some Advisers that received deficiency letters regarding missed or untimely reviews but had not taken action to correct such deficiencies.

Complete Procedures for Conducting Reviews

The Division also reported that:

• Some Advisers had standing policies requiring annual reviews but lacked adequate procedures to carry them out — for example, some Advisers lacked direction on how to perform testing and validation, which factors to weigh, or what kind of documentation to keep.
• Some Advisers failed to review topics that their own policies designated for annual testing (e.g., identity theft procedures).

Reviews Consistent with Written Procedures

The Risk Alert noted that some Advisers conducted timely reviews but did not follow their own procedures. For example, some reviews failed to cover the defined review period or scope, use specified work papers, or perform required tests. Additionally, some Advisers assessed outdated, superseded versions of policies and procedures.

Policies Aligned with Actual Practices

Furthermore, some Advisers’:

• Reviews did not adequately identify gaps between policies and practice, including risk areas central to the business that went unaddressed. Specific misses included:
• fee and expense billing deviated from disclosures (incorrect calculation methods, no proration, unapplied breakpoints, unpaid refunds);
• proxy voting policies were inconsistent with actual practice and disclosures;
• custody procedures omitted steps for ensuring accountants conducting surprise examinations received adequate information;
• marketing policies were not updated for the marketing rule; and
• filing procedures were not updated for Form CRS requirements.

The Division also observed that some Advisers’ policies permitted the delegation of services but lacked procedures for oversight. It also identified instances of non-compliance that were not recorded in the review.

Documentation and Recordkeeping

According to the Division, some Advisers generated review materials without retaining them in their books and records. Examples of such conduct included:

• discussing violations in review reports but not keeping the underlying testing records or recommended corrective actions;
• failing to prepare a required written review report; and
• only partially completing required checklists, workpapers, or templates.

Corrective Action

The Division observed that some Advisers failed to act on changes their own reviews recommended (e.g., improving proxy-voting disclosures, documenting client risk tolerances, and solidifying deeper best-execution and broker due diligence). In some of these cases, Advisers filed reports claiming they had taken corrective actions, but the underlying issues persisted.

Conclusion

The Division’s Risk Alert highlights recurring deficiencies discovered during routine examinations of Advisers, which the Division believes violates the Compliance Rule, which specifically requires Advisers to perform an annual review of the adequacy of their policies and procedures and the effectiveness of their implementation.

Accordingly, Advisers should consider (a) conducting an annual review at least every 12 months in accordance with their current policies and procedures, (b) confirming that the annual review is thorough and includes review of all applicable policies and business practices, (c) documenting such annual review in accordance with the Compliance Rule, and (d) carrying out corrective actions on issues identified in the annual report.

Failure to follow the Division’s guidelines and the Compliance Rule’s requirements may result in examination deficiencies, and, in extreme cases, referral to the SEC’s Division of Enforcement.