SEC Risk Alert: Examination Observations on Investment Adviser Annual Compliance Reviews

On September 14, 2026, the SEC Division of Examinations published a new Risk Alert describing what examiners find when they test compliance with the annual review requirement of Rule 206(4)-7(b) under the Investment Advisers Act of 1940. The staff groups its observations into five areas: timeliness, the completeness of the procedures advisers use to conduct reviews, the alignment of assessments with actual policies and practices, documentation, and the resolution of corrective actions.

The Division states that the Risk Alert represents staff views and creates no new obligations. The requirement has not changed, but firms now have added visibility into how examiners evaluate it. Importantly, the annual review should not be a static checklist. The SEC reiterated that advisers should consider compliance issues that arose during the year, changes in the firm's business or its affiliates, and regulatory developments that may require changes to the compliance program. Significant developments may also warrant an interim review rather than waiting for the next annual cycle.

Timeliness

The staff observed advisers that skipped a year outright, conducting reviews for 2021 and 2023 while omitting 2022. Others stretched review periods beyond twelve months after Chief Compliance Officer departures or operational changes. Some treated compliance training or personnel attestations as a substitute for the review itself. The staff also noted firms that received deficiency letters for missing or late reviews and took no corrective action.

The Risk Alert also closes off a common misreading. The 18-month period discussed when the Compliance Rule was originally adopted does not provide newly registered advisers today with an 18-month window to conduct their first review. Advisers must conduct reviews no less frequently than annually.

Completeness of Review Procedures

Several advisers required an annual review with testing and validation, without adopting procedures telling personnel how to test, what factors to weigh in judging adequacy, or what records to keep. In other cases, topics flagged elsewhere in the manual for annual testing, such as an identity theft program, never appeared in the review procedures and went untested.

Some advisers conducted reviews on schedule but not as written. Defined review periods went uncovered, specified workpapers went unused, and required tasks went unperformed. In some reviews, the staff found advisers assessing superseded versions of their own policies.

Alignment with Practices

For advisers, this may be one of the most important examination takeaways because it demonstrates that examiners are comparing the annual review not only to written policies, but also to the firm's actual business practices. Reviews failed to catch fee and expense billing that departed from advisory agreements and Form ADV: differing calculation methods, fees not prorated for intra-period deposits, breakpoints not applied, refunds not issued on terminating accounts. Proxy voting policies asserted a responsibility that the adviser disclaimed in client disclosure and did not perform. Custody procedures omitted the step of identifying custody accounts to the accountant conducting the surprise examination. Marketing procedures went unrevised after the marketing rule, and filing procedures went unrevised after Form CRS. Policies delegated functions without describing how the adviser oversees them. Instances of non-compliance identified during the period never appeared in the review.

Documentation

Advisers produced written reports discussing violations found during the review while failing to retain the underlying testing records, issue logs, and recommended corrective actions. Others required a written report in their policies and prepared none. Others required checklists or templates and completed them partially. Rule 204-2(a)(17)(ii) requires advisers to keep records of the annual review true, accurate, and current.

Corrective Action

Reviews recommended better proxy voting disclosure, documented client risk tolerances, deeper best execution analysis, and stronger broker-dealer due diligence. Advisers did not make the changes. Some reports stated corrective action was complete while the same issues persisted.

What to Do Next

Treat the Risk Alert as a testing framework for your next annual review. Confirm that:

• There are no gaps in the review period.
• Your procedures explain how testing will be performed and documented.
• The review covers material changes in the business, regulatory requirements, and compliance events during the year.
• Your written policies match actual practices.
• Prior findings and corrective actions have been fully resolved.

Bates Group assists SEC-registered investment advisers and dually registered firms with independent annual compliance reviews, annual review procedures, testing and documentation, and remediation tracking. If your firm has not yet completed its 2026 annual review, or if you are uncertain whether your existing review would satisfy the expectations described in the SEC's Risk Alert, Bates Group can help assess your current process, identify gaps, and support remediation before those issues surface during an SEC examination. Contact our team to discuss your annual review program.