On September 14, 2026, the Division of Examinations (“EXAMS”) of the U.S. Securities and Exchange Commission (the “SEC”) issued a Risk Alert highlighting deficiencies observed by the EXAMS Staff relating to investment advisers’ annual compliance reviews under Rule 206(4)-7 (the “Compliance Rule”) under the Investment Advisers Act of 1940. The Risk Alert provides a good reminder and a useful roadmap for registered investment advisers as they conduct and document their annual reviews and prepare for future SEC examinations.
Under the Compliance Rule, registered investment advisers must review, at least annually, the adequacy of their compliance policies and procedures and the effectiveness of their implementation. EXAMS noted that its Staff routinely requests information regarding these reviews during examinations and identified deficiencies across five principal areas: (i) timeliness; (ii) completeness of annual review policies and procedures; (iii) consistency between reviews and written procedures; (iv) documentation; and (v) remediation.
To date, our clients have generally not encountered significant deficiencies during annual exams, and the Risk Alert does not reflect a material departure from existing regulatory expectations. That said, the Risk Alert serves as an important reminder regarding an area of apparent interest for the Staff and the need to ensure that the annual review conducted is specifically tailored to the adviser’s actual practices regarding fees, billing, custody, proxy voting, etc.—especially when the adviser’s business practices have changed since the last annual review.
KEY OBSERVATIONS
Annual Means Annual
EXAMS reported that the Staff has observed advisers that skipped annual reviews, allowed more than 12 months to elapse between reviews or treated compliance training and employee attestations as substitutes for the required review. Notably, the Staff clarified its view that the 18-month period referenced in the Compliance Rule’s 2003 adopting release was available only following the rule’s original effective date; it is the Staff’s view that subsequent reviews must be conducted no less frequently than annually.
Policies Should Describe—and Advisers Should Follow—the Review Process
EXAMS identified policies that required annual reviews but did not provide sufficient procedures regarding testing, validation, evaluation or documentation. The Staff also observed advisers that had appropriate written procedures but failed to follow them, including by departing from prescribed scopes or testing requirements or reviewing superseded versions of compliance policies. The Staff specifically flagged that some advisers did not have policies and procedures describing the adviser’s process for assessing whether its policies and procedures were adequate and effectively implemented.
The Review Should Reflect the Adviser’s Actual Business
A significant theme of the Risk Alert is the need for annual reviews to identify gaps between written policies and actual business practices. Among other examples, EXAMS identified discrepancies involving fee and expense calculations, proxy voting, custody, marketing, regulatory filings and oversight of delegated functions. The Staff also observed advisers that failed to account for changes in their businesses when assessing whether their compliance programs remained adequate.
Document the Work—and Follow Through
EXAMS emphasized that advisers should retain documentation supporting their annual reviews, including testing performed, issues identified and recommended corrective actions. As noted above, the review and documentation should be consistent with the adviser’s own requirements under its policies and procedures. The Staff also identified advisers that documented recommended remediation but failed to implement it—or stated that remediation had occurred even though the underlying issue persisted.
WHAT ADVISERS SHOULD DO NOW
The Risk Alert does not create new legal obligations, but it provides a relatively detailed indication of how EXAMS Staff will assess annual reviews during examinations and signals a likely focus on this issue during exams. Registered advisers should consider whether their annual review processes (i) occur on a reliable annual timetable notwithstanding personnel or operational changes; (ii) are supported by written procedures that accurately describe the review process; (iii) test the adviser’s current policies against its actual business practices and regulatory obligations; (iv) create and retain sufficient documentation to demonstrate the work performed and conclusions reached; and (v) include a mechanism for tracking identified deficiencies through remediation.
Perhaps most importantly, the Risk Alert suggests that EXAMS will look beyond the existence of an annual review report to evaluate an adviser’s underlying policies and procedures relating to the annual review process and assess whether the review was sufficiently rigorous to identify compliance issues that an adviser reasonably should have detected. Advisers should therefore view the annual review not simply as a documentation exercise but as an opportunity to test whether their compliance program continues to reflect—and operate effectively in—their current business.
This publication is for general information purposes only. It is not intended to provide, nor is it to be used as, a substitute for legal advice. In some jurisdictions it may be considered attorney advertising.