Key Takeaways
- • The SEC's Division of Examinations issued a Risk Alert on September 14, 2026, identifying six recurring deficiencies in how registered investment advisers conduct annual compliance reviews under Rule 206(4)-7 of the Investment Advisers Act of 1940.
- • Untimely reviews represent a critical gap: the SEC found advisers failing to conduct annual reviews within 12-month cycles, with some citing operational disruptions or Chief Compliance Officer departures as reasons—deficiencies that persisted even after prior SEC deficiency letters.
- • Policy-to-practice misalignment emerged as a systemic issue, with advisers' written policies diverging from actual business operations in fee billing, proxy voting disclosures, custody procedures, and third-party service oversight.
- • Documentation and corrective action failures undermine compliance credibility: advisers failed to maintain testing records and workpapers required under Rule 204-2, while others claimed corrective actions were implemented without evidence they were actually completed.
- • The SEC treats annual compliance reviews as a foundational lens into adviser compliance health; deficiencies in timeliness, documentation, and follow-through signal broader regulatory risk and trigger heightened examination scrutiny.
Summary
The SEC's examination staff identified six principal deficiencies in registered investment advisers' execution of mandatory annual compliance reviews, as outlined in a Risk Alert issued September 14, 2026. The findings reflect patterns observed across recent examinations and carry significant implications for the alternative asset management industry, as annual compliance reviews constitute one of the first documents SEC examiners request during inspections.
The most prevalent issue centers on timeliness. The SEC found advisers that failed to conduct reviews on a consistent annual basis, with some experiencing gaps exceeding 12 months. Notably, several advisers had previously received deficiency letters addressing untimely reviews but continued the practice. The SEC explicitly rejected compliance training and attestations as substitutes for substantive annual reviews, signaling that procedural shorthand will not satisfy regulatory requirements. Additionally, advisers attributed delays to operational disruptions and Chief Compliance Officer transitions, explanations the SEC does not accept as justification for regulatory non-compliance.
A second critical gap involves incomplete procedures for conducting reviews. While some advisers adopted policies mandating annual reviews, they lacked documented methodologies for assessing policy adequacy and implementation effectiveness. The SEC identified missing elements including testing and validation procedures, evaluation criteria, review period definitions, and recordkeeping standards. This deficiency suggests advisers may misunderstand that Rule 206(4)-7 requires not only reviews but also documented processes for executing them.
The third deficiency—reviews inconsistent with written procedures—reveals a compliance execution problem. Even advisers conducting timely reviews deviated from their own documented procedures by failing to follow specified review periods, scopes, or workpaper formats. Some assessed the effectiveness of outdated policy versions, rendering reviews substantively meaningless. The SEC's finding here underscores that advisers will be held to their own procedural standards; written procedures create enforceable benchmarks against which the agency measures compliance.
Misalignment between policies and actual business practices represents perhaps the most material deficiency category. The SEC identified advisers whose written policies failed to reflect current operations across multiple risk domains: fee and expense billing practices that contradicted Form ADV disclosures and advisory agreements; proxy voting policies stating the adviser votes proxies in clients' best interests when the adviser had disclosed it does not vote proxies; custody policies omitting surprise examination procedures; and delegated service arrangements lacking oversight procedures. These gaps suggest compliance reviews failed to serve their intended function as mechanisms for identifying and remediating regulatory exposure.
Documentation failures and corrective action deficiencies rounded out the SEC's observations. Advisers created testing records and corrective action recommendations during reviews but failed to maintain them in books and records as required by Rule 204-2(a)(17)(ii). Some adopted policies requiring written annual review reports but never prepared them. Most significantly, the SEC found advisers that claimed to have implemented corrective actions without evidence of completion; in other instances, identified issues persisted despite assertions of remediation. These findings indicate advisers may view annual reviews as compliance theater rather than substantive operational discipline.
The SEC emphasized that annual compliance reviews are not discretionary or procedurally flexible exercises. The Risk Alert serves as notice that examination staff scrutinize review timeliness, procedural adherence, documentation completeness, and corrective action follow-through with particular intensity. Advisers should establish consistent annual review cadences, develop detailed testing and validation procedures, maintain comprehensive documentation, and implement demonstrable corrective actions. The agency's findings indicate that policy-to-practice alignment and proactive remediation of identified deficiencies will be central to examination outcomes.
The most prevalent issue centers on timeliness. The SEC found advisers that failed to conduct reviews on a consistent annual basis, with some experiencing gaps exceeding 12 months. Notably, several advisers had previously received deficiency letters addressing untimely reviews but continued the practice. The SEC explicitly rejected compliance training and attestations as substitutes for substantive annual reviews, signaling that procedural shorthand will not satisfy regulatory requirements. Additionally, advisers attributed delays to operational disruptions and Chief Compliance Officer transitions, explanations the SEC does not accept as justification for regulatory non-compliance.
A second critical gap involves incomplete procedures for conducting reviews. While some advisers adopted policies mandating annual reviews, they lacked documented methodologies for assessing policy adequacy and implementation effectiveness. The SEC identified missing elements including testing and validation procedures, evaluation criteria, review period definitions, and recordkeeping standards. This deficiency suggests advisers may misunderstand that Rule 206(4)-7 requires not only reviews but also documented processes for executing them.
The third deficiency—reviews inconsistent with written procedures—reveals a compliance execution problem. Even advisers conducting timely reviews deviated from their own documented procedures by failing to follow specified review periods, scopes, or workpaper formats. Some assessed the effectiveness of outdated policy versions, rendering reviews substantively meaningless. The SEC's finding here underscores that advisers will be held to their own procedural standards; written procedures create enforceable benchmarks against which the agency measures compliance.
Misalignment between policies and actual business practices represents perhaps the most material deficiency category. The SEC identified advisers whose written policies failed to reflect current operations across multiple risk domains: fee and expense billing practices that contradicted Form ADV disclosures and advisory agreements; proxy voting policies stating the adviser votes proxies in clients' best interests when the adviser had disclosed it does not vote proxies; custody policies omitting surprise examination procedures; and delegated service arrangements lacking oversight procedures. These gaps suggest compliance reviews failed to serve their intended function as mechanisms for identifying and remediating regulatory exposure.
Documentation failures and corrective action deficiencies rounded out the SEC's observations. Advisers created testing records and corrective action recommendations during reviews but failed to maintain them in books and records as required by Rule 204-2(a)(17)(ii). Some adopted policies requiring written annual review reports but never prepared them. Most significantly, the SEC found advisers that claimed to have implemented corrective actions without evidence of completion; in other instances, identified issues persisted despite assertions of remediation. These findings indicate advisers may view annual reviews as compliance theater rather than substantive operational discipline.
The SEC emphasized that annual compliance reviews are not discretionary or procedurally flexible exercises. The Risk Alert serves as notice that examination staff scrutinize review timeliness, procedural adherence, documentation completeness, and corrective action follow-through with particular intensity. Advisers should establish consistent annual review cadences, develop detailed testing and validation procedures, maintain comprehensive documentation, and implement demonstrable corrective actions. The agency's findings indicate that policy-to-practice alignment and proactive remediation of identified deficiencies will be central to examination outcomes.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.