SEC Examinations Division Issues Risk Alert on Investment Adviser Annual Compliance Reviews

Key Takeaways

• The SEC's Division of Examinations published a Risk Alert detailing observations on how investment advisers conduct the annual compliance review required under the Advisers Act compliance rule (Rule 206(4)-7).
• The alert identifies areas advisers should consider and encourages them to strengthen their review processes.
• Compliance teams should treat it as a preview of examination priorities and benchmark their current review practices against it.

Deep Dive

The SEC's Division of Examinations published a Risk Alert detailing observations on how investment advisers conduct the annual compliance review required under the Advisers Act compliance rule (Rule 206(4)-7). The alert identifies areas advisers should consider and encourages them to strengthen their review processes. Compliance teams should treat it as a preview of examination priorities and benchmark their current review practices against it.

The Risk Alert concerns the requirement that registered investment advisers review their compliance policies and procedures at least annually to assess their adequacy and the effectiveness of their implementation. The press release does not describe the specific deficiencies or observations, so compliance teams should read the full Risk Alert directly. The announcement signals that examiners have reviewed how advisers perform these reviews and found areas worth highlighting. Advisers should expect examiners to test annual review processes in upcoming examinations.

The Risk Alert does not create new legal requirements or change the existing annual review obligation. Risk Alerts are staff observations and are not rules or formal guidance. However, they usually reflect issues seen in examinations, including deficiencies cited in deficiency letters, and they often precede enforcement activity for repeated or egregious failures. The alert encourages advisers to reflect on their practices, policies, and procedures and to make appropriate modifications to their annual review processes. No compliance deadline is specified, though the annual review cycle means advisers should assess readiness at their next scheduled review, and ideally sooner.

Recommended actions include the following:
- Obtain and review the full Risk Alert, and map its observations to the firm's current annual review methodology.
- Confirm that the review is documented, covers all material business lines and risk areas, and tests the effectiveness of implementation rather than only the existence of policies.
- Assess whether the review incorporates lessons from regulatory changes, business changes, incidents, and prior testing results.
- Verify that findings are tracked to remediation with clear ownership and timelines, and that the chief compliance officer (CCO) has adequate resources and authority.
- Brief senior management and, where applicable, the board on the alert and any planned enhancements.

The risk implications are moderate but meaningful. Advisers with weak, undocumented, or purely check-the-box annual reviews face greater exposure to examination deficiency findings and possible enforcement referrals, including potential individual CCO liability in serious cases. Proactive enhancement and documentation of changes made in response to the alert can demonstrate good faith and a culture of compliance, which may mitigate regulatory outcomes.

Source: Securities and Exchange Commission