SEC Risk Alert: 5 Annual Compliance Review Deficiencies Investment Advisers May Need to Fix

September 16, 2026

What happened?

On September 14, 2026, the SEC Division of Examinations published a Risk Alert on observations of investment advisers’ annual compliance reviews. Although registered investment advisers have had to conduct annual compliance reviews for over twenty years, the SEC Division of Examinations has observed a number of deficiencies that investment advisers should consider as they complete these reviews.

---

The SEC’s Observations

Recall that Rule 206(4)-7 requires registered investment advisers to adopt and implement written compliance policies and procedures and conduct a review of these policies and procedures at least annually. This annual compliance review must assess the adequacy of the policies and procedures and the effectiveness of their implementation. Any compliance matters, changes to the firm, or new regulatory developments in the past year should be considered to see if policies and procedures should be revised. Lastly, advisers must document records of the review in a true, accurate, and current manner. The Risk Alert highlights issues around this annual review requirement and where investment advisers are falling short.

---

Timeliness of Annual Reviews

The requirement is for reviews “at least annually,” but many advisers did not perform reviews each year:

• Gaps in annual reviews (e.g., conducting reviews for 2021 and 2023 but omitting 2022).
• Reviews covering periods over 12 months, such as extending the review period after the departure of a Chief Compliance Officer.
• Replacing an annual review with compliance trainings and/or certification from personnel that compliance rules are being followed.
• Taking no action to complete reviews after receiving an SEC deficiency for not performing them in a timely manner.

“Annual” is intended to mean annual.  If you find yourself with a gap, perform an accurate stub review to get back on an annual cadence, but do not backdate or falsify a review. See our prior coverage on a CCO charged for backdating annual reviews when SEC examiners discovered a multi-year gap.

---

Adopting Procedures for Conducting Annual Reviews

Examiners noted firms that had policies and procedures requiring annual reviews, but had not adopted complete procedures for conducting the reviews:

• Polices that required documented annual reviews, with testing and validation as part of the process – and the adviser did not document the review, complete all the testing, or obtain the stated validations from their own policies.
• Policies that lacked factors to consider when evaluating adequacy and effectiveness.
• Policies that required practices, services, and/or operations to be assessed during the review – and the annual review failed to include those topics.

Conducting annual reviews must be done consistently with your written policies and procedures. Reconcile current reviews to current policies and update your written policies as needed.

---

Aligning Compliance Policies with Actual Practices

Here the exam staff observed a multitude of mismatches of the advisory business to compliance programs. These included failures to adopt policies for key risk areas related to their business and failures to update policies for changes in business activities and affiliations. When examiners encounter issues in a core area of an adviser’s business, operations, and services, those are compared to the annual review and the written policies and procedures, and then any inconsistencies are discovered. Examples from the Risk Alert included:

• Fee and expense billing policies inconsistent with client disclosures (e.g., different calculation methodology, proration for large deposits, breakpoints, refunds on termination, etc.).
• Proxy voting policies stating the firm has responsibility for voting when disclosing to clients that the firm does not vote proxies and did not vote proxies in practice.
• Custody policies that omitted steps to ensure identification of accounts over which the firm has custody for the independent public accountants performing the surprise examination.
• Marketing policies that were not updated to reflect the new Marketing Rule adopted in 2024.
• Regulatory filing procedures that were not updated for Form CRS.
• Policies that delegate service or operation tasks to third parties without describing oversight of these third parties to prevent violations of the Advisers Act.
• Incidents of non-compliance that were reported or identified in compliance testing but were not addressed or included in the annual review.

The challenge for investment advisers is taking the comprehensive view. Change is a constant. Changing business activities, newly acquired affiliates, new regulations, and evolving advisory agreements can cause compliance policies to become stale and inaccurate. The last bullet shows that even when compliance has aligned policies to practices, the game is not over. Incidents of non-compliance need to be addressed, and this leads to the last observation in the Risk Alert.

---

Taking Corrective Actions for Issues Identified in Annual Reviews

The SEC staff observed firms that did not modify their compliance programs even after annual reviews recommended changes. Examples included annual reviews that identified the need to improve proxy voting disclosures, documentation of client risk tolerances, and/or conducting more thorough due diligence of broker-dealer execution with no corrective action taken to fill those compliance needs. Similarly, examiners observed advisers who made some changes based on annual review recommendations but did nothing further when the same non-compliant issue from the prior review appeared in subsequent annual reviews. Lack of corrective action or half measures that fail to effectively cure the issue will be spotted by examiners.

---

What does this mean for me?

This Risk Alert should serve as a reminder that annual compliance reviews are a fundamental requirement for registered investment advisers and remain a key focus area for SEC examiners. For new registrants, all of these observations are valuable and point to common deficiencies a firm can fall into. For experienced registrants, be aware that change is constant, which means your compliance policies and procedures will likely change as your business, services, and operations evolve. Reacting to changes such as new products, offering private funds for the first time, and the acquisition of new businesses were all cited in the 2026 Examination Priorities. Your compliance manual and the annual review of that manual should identify needed revisions.

The most telling item in this Risk Alert is the last one: taking corrective action for issues identified in annual reviews. An effectively implemented compliance program will include all sorts of testing and monitoring that will, in turn, generate findings. Annually, if not sooner, those findings should prompt corrective action. Whether it is confronting an individual with a pattern of non-compliance, updating stale procedures or inaccurate disclosures, or creating new policies and procedures for new risk areas, compliance programs must rise to meet the firm’s ever-changing needs.

This December marks the end of the first full year of Amended Regulation S-P. As you review any incidents under your incident response plan, think back to this Risk Alert. If you had an incident, what corrective action would avoid the next incident? What changes could be made?  How would you explain staying the course with current cybersecurity controls in the face of a documented breach? Both this Risk Alert and the SEC’s Reg S-P webinar indicate that you are likely to be asked.

If you have questions or could use guidance to understand what this risk alert may mean for your firm’s compliance practices, let us know. We provide comprehensive compliance support including a written annual compliance review, ongoing compliance monitoring and testing to support that review, tailored policies and procedures, and a dedicated team of compliance professionals to prepare your next filing and keep you up to date on the latest regulatory changes.