On September 14, 2026, the Securities and Exchange Commission’s (SEC’s) Division of Examinations (the Division) issued a Risk Alert (the Alert) providing observations from its examinations of SEC-registered investment advisers (advisers) regarding Rule 206(4)-7 annual compliance reviews.
The Division staff identified issues regarding: (1) the timeliness of annual reviews; (2) the completeness of advisers’ policies and procedures for conducting such reviews; (3) the alignment of reviews performed with advisers’ policies, procedures, and practices; (4) the documentation maintained in connection with those reviews; and (5) the resolution of corrective actions arising from matters identified during reviews.
Key Takeaways
Rule 206(4)-7 of the Investment Advisers Act of 1940 (Advisers Act) requires advisers to adopt and implement written compliance policies and procedures. Rule 206(4)-7 further requires that advisers review their compliance policies and procedures at least annually to evaluate their adequacy and effectiveness. Per the Alert, when performing this review, advisers should:
- Conduct the review at least annually. Annual reviews should not cover periods longer than 12 months.
- Adopt policies and procedures governing annual reviews, including meaningful mechanisms for compliance personnel to gauge whether the adviser’s compliance policies and procedures are effective, as required by Rule 206(4)-7.
- Evaluate whether compliance policies and procedures reflect current business practices, with respect to fee/expense billing, proxy voting, custody, marketing, and regulatory filings.
- Treat any documents created during the review process as Advisers Act books and records.
- Implement corrective actions recommended or identified in annual reviews and track their resolution.
Staff Observations
The staff identified deficiencies in the following areas:
Conducting Timely Annual Reviews
The staff observed advisers that did not perform reviews of their compliance policies and procedures at least annually, as required by Rule 206(4)-7. Examples include:
- Gaps in the review cycles. Advisers conducted reviews for 2021 and 2023 but omitted 2022.
- Extended review cycles. Advisers performed reviews for periods covering more than 12 months, performed their initial review 18 months after registration, and allowed extensions due to business, operational, and personnel changes (e.g., CCO departures).
- Substitution of training. Instead of performing any annual review, advisers treated compliance training or annual personnel attestations as satisfying the review requirement.
- Recidivism. Advisers failed to take corrective action after receiving previous deficiency letters from the staff on examinations for failure to perform their annual review.
Adopting Complete Policies and Procedures for Conducting Annual Reviews
The staff found that some advisers required annual policy reviews but lacked complete procedures in that there were no mechanisms for assessing whether those policies were adequate as required by Rule 206(4)-7. Examples include:
- Insufficient procedures. Advisers maintained policies requiring documentation of annual reviews along with testing and validation of part of the review process. However, advisers did not document processes to test and validate compliance procedures, the factors to consider when assessing the effectiveness of policies and procedures, and the type and level of documentation to support such reviews.
- Omitted review topics. Advisers identified practices and operations for annual review but failed to include them in their compliance policies and procedures for annual reviews. As a result, the annual reviews did not cover such topics.
Conducting Annual Reviews Consistent With Written Procedures
The staff observed that advisers conducted timely annual reviews but did not conduct them in a manner consistent with their written procedures.
- Failure to follow policies and procedures. Advisers did not follow their own policies and procedures that required them to cover a defined review period, use specified work documentation, or perform certain tests, in each case as set forth in relevant policies and procedures.
- Review of incorrect or outdated documents. Some annual reviews assessed the effectiveness of outdated versions of policies and procedures that had been updated and superseded prior to the review.
Ensuring Compliance Policies and Procedures Fully Address and Align With Practices
The staff found that some advisers’ annual reviews failed to identify gaps between their written policies and their actual practices. For example, reviews failed to detect issues related to:
- Fee and expense billing. Advisers’ billing practices deviated from policies and procedures and/or disclosures in advisory agreements or Form ADV (e.g., using incorrect methodologies, failing to prorate fees, not applying breakpoints, or not issuing refunds for terminated accounts).
- Proxy voting. Policies that claimed advisers would vote proxies in clients’ best interests, while advisers disclosed to clients that they did not vote proxies at all, and failed to do so in practice.
- Custody. Policies that failed to ensure accounts for which advisers had custody were identified to the independent accountants conducting surprise examinations.
- Marketing. Policies were not updated to reflect adoption of the Advisers Act marketing rule.
- Regulatory filings. Policies were not updated to require filing Form CRS for retail clients.
- Oversight of service providers. Policies that permitted use of outside service providers for certain operations or services but failed to address how the adviser would oversee them to prevent Advisers Act violations.
- Tracking instances of non-compliance. Instances of non-compliance identified during the review period that were neither addressed nor recorded in annual reviews.
Maintaining Annual Review Documentation
The staff observed advisers that documented their annual reviews but failed to maintain documents such as Advisers Act books and records.
- Failure to retain records. Advisers discussed compliance violations in their annual review reports but failed to maintain documentation or other records regarding the testing performed, issues identified, and recommendations.
- Failure to prepare reports. Advisers adopted policies requiring written annual review reports to cover certain topics (e.g., recommendations for improvement, material policy changes, and material compliance issues that required remedial action during the prior year) but did not prepare such reports.
- Incomplete documentation. Advisers adopted policies requiring annual reviews to be documented using specific formats (e.g., checklists, workpapers, or templates) but failed to execute them.
Taking Corrective Actions for Issues Identified in Annual Reviews
The staff observed that advisers failed to act on changes to compliance policies, disclosures, or business practices that were recommended in their annual reviews. Advisers failed to implement the associated recommendations, including instances in which advisers indicated corrective actions were already implemented but the identified issues persisted.
Final Thoughts
The Alert reinforces the Division’s expectation that advisers treat annual compliance reviews as a substantive evaluation of their compliance programs, not as a check-the-box exercise. Advisers should consider assessing whether their current review procedures address each of the areas highlighted by the staff, including the timeliness of reviews, the completeness of supporting policies and procedures, alignment between written procedures and actual practices, retention of review documentation, and implementation of corrective actions identified as part of the annual review process.
Advisers that have not recently evaluated their annual review processes should consider doing so promptly in light of the staff’s continued examination focus in this area and the publication of these observations.
