On September 14, 2026, the Securities and Exchange Commission’s Division of Examinations (“EXAMS”) issued a Risk Alert identifying deficiencies observed in SEC-registered investment advisers’ annual compliance reviews.
Rule 206(4)-7 under the Investment Advisers Act of 1940 (the “Compliance Rule”) requires registered investment advisers to review, no less frequently than annually, the adequacy of their compliance policies and procedures and the effectiveness of their implementation. Based on recent examinations, EXAMS identified a number of instances in which advisers either failed to conduct these reviews appropriately or could not demonstrate that their reviews were sufficiently comprehensive.
The Risk Alert is particularly notable because it provides advisers with a relatively detailed roadmap of what EXAMS expects to see when evaluating an annual compliance review. Among other things, EXAMS focused on whether reviews are timely, whether advisers have established adequate procedures governing how reviews are conducted, whether testing corresponds with those procedures, whether reviews identify gaps between written policies and actual practices, whether appropriate documentation is retained, and whether identified deficiencies are actually remediated.
Background
The Compliance Rule requires SEC-registered investment advisers to adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and its rules by the adviser and its supervised persons. Advisers must review those policies and procedures at least annually to determine both their adequacy and the effectiveness of their implementation.
As part of this process, advisers should consider compliance matters that arose during the preceding year, changes to the business activities of the adviser or its affiliates, and regulatory developments that may require revisions to existing policies and procedures. Significant compliance events or changes in an adviser’s business may also warrant an interim review rather than waiting until the next regularly scheduled annual review. Advisers are also required to maintain records documenting their annual reviews.
Examination Observations
Timeliness of Annual Reviews
EXAMS observed advisers that failed to conduct reviews at least annually. Examples included advisers that skipped a year entirely or conducted reviews covering periods longer than 12 months.
Importantly, EXAMS also observed advisers that conducted their first review 18 months after registering with the SEC. The Risk Alert clarifies that the 18-month period discussed in the Compliance Rule’s 2003 adopting release was a transition provision available following the Rule’s original effective date and does not provide newly registered advisers with an 18-month period to conduct their first review. Accordingly, newly registered advisers should generally structure their compliance programs to ensure that reviews occur no less frequently than annually.
EXAMS also cautioned that compliance training and annual employee attestations are not substitutes for an annual review.
Incomplete Annual Review Procedures
EXAMS identified advisers whose compliance manuals required an annual review but did not contain sufficiently developed procedures explaining how that review should be conducted.
For example, some policies required testing and validation but did not establish the testing procedures personnel should follow, the factors that should be considered when assessing the results, or the documentation that should be maintained. Other compliance manuals required particular areas to be tested annually but failed to incorporate those requirements into the firm’s annual review procedures, resulting in those areas being omitted from the review.
The observations suggest that merely stating in a compliance manual that the CCO will conduct an annual review may be insufficient. Advisers should have a reasonably defined process addressing the scope, testing, documentation, and evaluation involved in the review.
Following the Firm’s Own Procedures
EXAMS also observed advisers that conducted timely reviews but failed to follow their own written procedures.
Examples included failing to cover the review period or scope required by the compliance manual, failing to use required workpapers or documentation, and failing to perform specified testing. In some instances, advisers tested outdated versions of policies and procedures that had already been superseded.
Accordingly, advisers should ensure that the methodology actually used to conduct the annual review corresponds with the methodology described in their compliance policies and procedures.
Failure to Identify Gaps Between Policies and Actual Practices
A significant portion of the Risk Alert addresses annual reviews that failed to identify discrepancies between advisers’ written policies, disclosures and actual practices.
EXAMS provided several examples, including:
- Fees and expenses: Annual reviews failed to identify practices inconsistent with policies or client disclosures, including different fee-calculation methodologies, failure to prorate fees, failure to apply applicable breakpoints and failure to provide refunds upon termination.
- Proxy voting: Policies indicated that advisers would vote client securities while client disclosures and actual practices indicated otherwise.
- Custody: Policies failed to include procedures designed to ensure that all accounts over which the adviser had custody were identified to the independent public accountant conducting a surprise examination.
- Marketing: Policies had not been updated to reflect the SEC’s Marketing Rule.
- Regulatory filings: Procedures failed to address Form CRS requirements applicable to advisers with retail clients.
- Delegated functions: Policies delegated certain services or operations to other parties without addressing how the adviser would oversee those delegated responsibilities.
- Compliance violations: Known incidents of non-compliance occurring during the review period were not appropriately incorporated into the annual review.
EXAMS also observed situations in which advisers failed to consider significant changes to their businesses when evaluating their compliance programs. The Risk Alert reiterates that compliance policies should be tailored to the risks presented by an adviser’s particular operations and that the annual review should consider changes in the adviser’s activities that may affect those risks.
Documentation of the Annual Review
EXAMS separately emphasized the importance of maintaining documentation supporting the annual review.
In some cases, advisers prepared annual review reports discussing compliance violations but did not retain the underlying testing records, documentation of identified issues or recommended corrective actions. Other advisers had policies requiring preparation of a written annual review report but failed to prepare one.
EXAMS also observed advisers whose procedures required the use of particular checklists, workpapers or templates, but that failed to complete or retain those materials.
These observations demonstrate that an adviser should generally be able to substantiate not only that an annual review occurred, but also what was reviewed, what testing was performed, what issues were identified, and what remedial actions were recommended.
Corrective Actions
Finally, EXAMS focused on whether advisers actually implemented corrective actions identified through their annual reviews.
Staff observed advisers whose reviews recommended changes relating to areas such as proxy voting disclosures, documentation of client risk tolerances, best execution analysis and broker-dealer due diligence, but that failed to implement those recommendations.
Particularly problematic were instances in which annual review reports stated that corrective actions had been completed even though the underlying deficiencies continued.
Takeaway
The Risk Alert indicates that EXAMS views an annual compliance review as more than a periodic update to an adviser’s compliance manual. Instead, the review should function as a documented assessment of whether the adviser’s compliance program appropriately addresses its current business risks and whether its written policies are actually being followed in practice.
Salus GRC recommends that SEC-registered investment advisers review their annual compliance review procedures in light of the Risk Alert. In particular, advisers should confirm that reviews are conducted at least annually; that their compliance manuals adequately describe the review process; that the scope of testing reflects both the firm’s written policies and its actual business activities; and that appropriate workpapers and supporting documentation are retained.
Advisers should also establish a process for documenting identified deficiencies and tracking remedial actions through completion. Firms that have experienced significant changes in their businesses, personnel, investment strategies, client base, operations or applicable regulatory requirements should consider whether those developments require additional testing, amendments to existing policies and procedures or, where appropriate, an interim compliance review.