SEC Annual Compliance Reviews: Six Recurring Failures Under Rule 206(4)-7

Summary: The SEC’s September 2026 Risk Alert identifies six recurring deficiencies in investment advisers’ annual compliance reviews under Rule 206(4)-7, from missed deadlines and incomplete testing to inadequate records and unresolved findings. This update explains what SEC exam staff found and the practical steps advisers can take to strengthen their review process.

SEC Risk Alert Targets Annual Compliance Review Failures

On September 14, 2026, the SEC’s Division of Examinations published a Risk Alert, Examinations Observations Regarding Investment Adviser Annual Compliance Reviews (Risk Alert), addressing deficiencies observed in examinations of SEC-registered investment advisers’ annual reviews under Rule 206(4)-7 of the Investment Advisers Act of 1940 (Advisers Act). The staff identified recurring problems: reviews were late or omitted; annual review procedures were incomplete; reviews did not follow the firm’s own procedures; policies did not reflect the firm’s actual business and practices; supporting records were not retained; and identified problems were not corrected. (Risk Alert at 1-5.) For chief compliance officers, the practical point is straightforward. The annual review must assess both whether the compliance program remains appropriate for the firm’s business and whether it is working in practice. Updating the compliance manual, conducting annual training, or collecting employee attestations does not, by itself, satisfy that requirement.

The Risk Alert reflects the views of the Division of Examinations staff. It is not a Commission rule or enforcement order, has no independent legal force or effect, and creates no new obligations. It addresses SEC-registered investment advisers; observations concerning registered investment company annual reviews under Investment Company Act Rule 38a-1 were addressed separately. (Risk Alert at 1 nn.1-2.) Even so, the Alert is useful because it identifies the deficiencies staff has recently observed and the areas likely to receive attention when examiners evaluate an adviser’s annual review process.

Six SEC Annual Compliance Review Takeaways

• Annual means annual. The staff cited advisers that skipped a year, used review periods longer than 12 months, or delayed reviews because of operational or personnel changes, including CCO departures. The staff also identified first reviews conducted 18 months after SEC registration and explained that the 18-month period discussed in the 2003 adopting release was limited to the rule’s original transition. (Risk Alert at 2 & n.8.)
• Training and attestations are inputs, not the review. Several advisers told examiners that compliance training or annual employee certifications satisfied the requirement. The staff did not agree. (Risk Alert at 2.)
• The firm’s written procedures matter. Examiners compared the work performed with the adviser’s own procedures and identified required tests that were not performed, required workpapers that were not completed, and reviews based on superseded versions of policies and procedures. (Risk Alert at 2-3.)
• The review has to test the business as it is run. The staff’s examples are fee billing, proxy voting, custody, marketing, Form CRS, oversight of delegated functions, and compliance incidents the firm already knew about that never made it into the review. (Risk Alert at 3-5.)
• Keep the workpapers. Rule 204-2(a)(17)(ii) requires the adviser to keep the records documenting its annual review. Advisers that did the testing, wrote up recommendations, and then failed to retain any of it were cited. (Risk Alert at 5.)
• Corrective action must actually be completed. The staff found recommendations that were not implemented, including matters described in annual review reports as corrected even though the underlying issue persisted. (Risk Alert at 5.)

What Rule 206(4)-7 Requires of Investment Advisers

Rule 206(4)-7 has three parts. Paragraph (a) requires an adviser to adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and its rules by the adviser and its supervised persons. Paragraph (b) requires the adviser to review, no less frequently than annually, the adequacy of those policies and procedures and the effectiveness of their implementation. Paragraph (c) requires a designated chief compliance officer to administer them. 17 C.F.R. § 275.206(4)-7. So the review has two subjects, design and operation. Does the program fit the business and its risks, and does it work in practice?

The Risk Alert restates the Commission’s guidance from the 2003 adopting release. The review should consider compliance matters that arose during the prior year, changes in the business activities of the adviser and its affiliates, and changes in the Advisers Act or applicable rules that may warrant revisions to the compliance program. Advisers should also consider whether significant compliance events, changes in business arrangements, or regulatory developments warrant an interim review. (Risk Alert at 1 & nn.4-5, citing Compliance Programs of Investment Companies and Investment Advisers, Advisers Act Rel. No. 2204 (Dec. 17, 2003).) Rule 206(4)-7 does not prescribe a separate schedule for interim reviews; the question is whether developments during the year warrant one.

A related point warrants clarification. In August 2023, as part of the private fund adviser rulemaking, the Commission amended Rule 206(4)-7(b) to require registered advisers to document their annual reviews in writing. The Fifth Circuit vacated that rulemaking in its entirety on June 5, 2024, in National Association of Private Fund Managers v. SEC, and the Commission subsequently confirmed that the amendment is no longer in effect. Rule 206(4)-7(b), as currently in effect, does not itself require a written annual review report. That does not eliminate the recordkeeping obligation. Rule 204-2(a)(17)(ii) requires advisers to make and keep records documenting the annual review, and an adviser’s own procedures may require a written report, checklist, workpapers, or other specified documentation.

Why Annual Compliance Reviews Matter in SEC Examinations

Annual review materials are routinely requested in SEC examinations. The Division’s September 2023 Risk Alert on examination scoping and document requests, cited in the new Alert, identifies annual and interim reviews of policies and procedures and related reports among the information typically requested. (Risk Alert at 2 & n.7.) Examiners can then compare the review with the adviser’s written procedures and with evidence of how the business actually operated. The September 2026 Risk Alert illustrates that approach in areas including fee billing, custody, marketing, disclosures, and delegated functions. (Risk Alert at 3-5.) A review may therefore be timely and well documented yet still be deficient if it fails to identify material inconsistencies between the firm’s policies, disclosures, and actual practices.

The consequence is not limited to the annual review itself. A failure to conduct the required review can violate Rule 206(4)-7, and an ineffective review may also fail to identify substantive compliance problems elsewhere in the business. For that reason, the quality of the annual review can affect how examiners evaluate the broader compliance program.

Six Recurring Annual Review Failures Identified by SEC Staff

Late, Skipped, or Substituted Annual Reviews Cited by SEC Staff

Examiners found advisers that conducted reviews for 2021 and 2023 but not 2022, advisers whose review periods exceeded 12 months, and advisers that delayed reviews because of business, operational, or personnel changes, including CCO departures. The staff also identified advisers that had previously received deficiency letters for failing to conduct annual reviews, or to conduct them timely, but had not corrected the issue. The Risk Alert describes those repeat failures as recidivist conduct. (Risk Alert at 2.)

Footnote 8 is particularly important for newly registered advisers. The staff identified first reviews conducted 18 months after SEC registration and explained that the 18-month period referenced in the 2003 adopting release applied to the original transition following the Compliance Rule’s 2004 effective date. The staff’s position is that subsequent reviews must be conducted no less frequently than annually. (Risk Alert at 2 & n.8.) Newly registered advisers should therefore schedule the first review on an annual timetable rather than rely on the historical 18-month transition language.

Timing problems are largely preventable. The firm should define the review period, calendar the completion date, and ensure that responsibility for pending annual review work is reassigned when compliance personnel change. Training and employee attestations may provide useful inputs, but they do not replace the review itself.

Annual Review Procedures That Do Not Explain Required Testing

Some advisers’ manuals required an annual review, complete with testing and validation, but did not tell anyone how to do it. Nothing said what tests to perform, what factors to weigh in judging adequacy and effectiveness, or what documentation to produce. Others scattered review requirements through the manual (identity theft policies that called for annual testing, for example) and then left those topics out of the annual review procedure, so the review was incomplete by the firm’s own terms. (Risk Alert at 2-3.)

The practical step is to read the annual review procedure against the rest of the compliance manual. If another policy requires annual testing, review, or validation, the annual review process should account for that requirement. Each required test should also be described with enough specificity for the responsible person to perform it and evaluate the result. The Risk Alert does not prescribe a particular sample size, checklist, or testing methodology; its focus is whether the adviser’s stated process is complete and is actually followed.

Annual Compliance Reviews That Depart from Written Procedures

A review can be on time and still deficient if the work does not match the procedure. Examples included reviews that did not cover the required period or scope, did not use the required workpapers, skipped designated tasks or tests, and, in some cases, assessed policy versions that had been superseded before the review period began. (Risk Alert at 3.)

If a firm’s manual requires more testing or documentation than the firm believes is necessary, the firm should either perform the required work or amend the procedure prospectively. Performing less than the written procedure requires creates an avoidable examination issue. If procedures change during the review period, the annual review should identify which requirements applied during the relevant period. A later amendment does not establish that the firm complied with the procedure previously in effect.

Compliance Policies That Do Not Match the Adviser’s Business Practices

The most substantive group of observations concerns reviews that failed to catch significant risks the policies did not address, changes in the adviser’s activities the policies did not reflect, or the gap between what the policies and disclosures said and what the firm did. In some cases, the CCO simply had not been told about business or operational changes that affected the scope of the review, which is its own supervisory problem. Examiners often found these gaps by identifying a problem in the business first and then comparing it with the policies and the review. (Risk Alert at 3-5.) The staff’s examples follow.

• Fees and expenses. Reviews failed to identify billing practices that were inconsistent with firm policies or client disclosures in advisory agreements and Form ADV. Examples included using a different fee calculation methodology, failing to apply breakpoints, failing to prorate fees for certain intra-period deposits, and failing to issue refunds on terminated accounts. The staff cross-references its June 9, 2026 Risk Alert on economic conflicts of interest, which reported similar billing observations. (Risk Alert at 4 & n.11.) For many advisers, recalculating a risk-based sample of advisory fees against the governing agreement and disclosures is a direct way to test whether billing practices match what the firm has promised clients.
• Proxy voting. Some policies stated that the adviser would vote proxies in clients’ best economic interests, while the adviser disclosed to clients that it did not vote and, in practice, did not vote. Footnote 12, citing the Commission’s 2019 proxy voting guidance (Advisers Act Rel. No. 5325), makes the underlying point. An adviser is not required to accept voting authority, but an adviser with discretionary authority and no narrower written arrangement is responsible for deciding whether to vote, including a decision not to vote. The policy, the disclosure, and the practice have to say the same thing. (Risk Alert at 4 & n.12.)
• Custody. Custody policies omitted procedures for identifying the accounts over which the adviser had custody to the independent public accountant performing the surprise examination under Rule 206(4)-2(a)(4). For an adviser subject to the surprise examination, the review is the place to confirm that the accountant received a complete and accurate account population. (Risk Alert at 4 & n.13.)
• Marketing and Form CRS. Marketing policies had not been updated for the amended Marketing Rule, which had a compliance date of November 4, 2022, and filing procedures did not reflect the obligation to file Form CRS for advisers with retail clients. The staff points to its own Marketing Rule Risk Alerts of April 17, 2024 and December 16, 2025, either of which should have prompted someone to reread that section of the manual. (Risk Alert at 4 & nn.14-15.)
• Delegated functions and known incidents. The staff observed policies that delegated services or operations to third parties but did not identify how the adviser would oversee those delegated responsibilities. It also found annual reviews that omitted known incidents of non-compliance identified during the review period. (Risk Alert at 5.) The point is practical: where a function is performed by a third party, the compliance program should address how the adviser oversees that function, and known compliance events should be considered in evaluating whether the program operated effectively during the year.

Missing Annual Review Records and Workpapers

Some advisers did the testing, wrote up corrective action recommendations, and then failed to keep any of it. Annual review reports discussed violations without any retained record of the tests performed, the issues identified, or the corrective actions proposed. Others had adopted procedures requiring a written report addressing recommendations for improvement, material changes to policies, and material compliance issues requiring remediation, and never produced one. Still others required checklists, workpapers, or templates that were never completed. (Risk Alert at 5 & n.16.)

Rule 204-2(a)(17)(ii) requires advisers to make and keep records documenting the annual review, and Rule 204-2(e)(1) generally requires those records to be preserved for five years from the end of the fiscal year during which the last entry was made, with the first two years in an appropriate office of the adviser. 17 C.F.R. § 275.204-2(a)(17)(ii), (e)(1). Neither provision prescribes a particular form of annual review documentation, and the vacated 2023 amendment is not in effect. But if the firm’s procedures require a report, checklist, workpapers, or other documentation, those records should exist and be retained. At a minimum, the retained record should be sufficient to show the work performed and the basis for the review’s conclusions.

Annual Review Findings That Were Not Remediated

Several advisers’ reviews identified needed changes to policies, disclosures, and practices (the examples involve proxy voting disclosures, documentation of client risk tolerances, and best execution and broker-dealer due diligence analysis), and then nothing happened. In some cases the written report said corrective action had been taken while the problem persisted into the next review. (Risk Alert at 5.)

Each open finding should have a responsible person, a target date, and documentation showing its disposition. If the issue concerns the operation of a control, revising the written procedure alone may not establish that the problem has been corrected; follow-up testing may be appropriate. If management does not adopt a recommendation, the record should reflect that decision, the reason for it, and any alternative response. The annual review process should also track prior findings so that unresolved issues do not simply fall out of the next year’s review.

Annual Compliance Review Checklist for Investment Advisers

1. Confirm timing. Verify that an annual review was completed for each required period and that the review cycle does not exceed 12 months. Newly registered advisers should not rely on the historical 18-month transition language discussed in the 2003 adopting release. If a review is overdue, address the gap promptly and document the steps taken.
2. Compare the manual with the review process. Identify each policy that requires annual testing, review, or validation and confirm that the annual review procedure addresses it. If the procedure requires a particular test, workpaper, checklist, or report, confirm that the work was completed and the record retained. If a requirement no longer reflects the firm’s intended process, amend it prospectively rather than leaving a continuing gap between the written procedure and actual practice.
3. Test the business as it actually operates. Depending on the adviser’s business, this may include recalculating a risk-based sample of advisory fees against client agreements and Form ADV; comparing proxy voting policies, disclosures, and actual practice; reconciling custody determinations with information provided to an independent accountant; confirming that marketing and Form CRS procedures reflect current requirements; and reviewing oversight of functions performed by third parties. Tailor the scope to the firm’s business, risks, and compliance history.
4. Close the loop on known issues. Reconcile compliance incidents, prior annual review findings, and any prior SEC examination deficiencies to the current review. Give each prior finding a documented status, and support matters marked complete with evidence of what was done. If a CCO transition occurs during the review cycle, expressly reassign responsibility for work in progress and the next annual review.

None of this needs to be applied mechanically. The staff acknowledges that some observations will not apply to every adviser and that the adequacy of a compliance program depends on the firm’s profile and circumstances. (Risk Alert at 6.)

SEC Annual Compliance Review FAQs

Must Investment Advisers Test Every Topic in the SEC Risk Alert?

No. The staff expressly notes that some observations may not be relevant to a particular firm and that the adequacy of compliance and risk management systems depends on the firm’s profile and circumstances. The annual review should be risk-based and tailored to the adviser’s business. At the same time, a firm should not omit a test or review that its own procedures expressly require. (Risk Alert at 3 & n.9, 6.)

Can Compliance Training or Employee Attestations Satisfy an Investment Adviser’s Annual Review Requirement?

Not on its own. The staff rejected that argument. Training and attestations can supply information for the review, but the adviser must still assess whether its policies are adequate and effectively implemented. (Risk Alert at 2.)

Does Rule 206(4)-7 Require a Written Annual Review Report or Outside Reviewer?

Neither is required by Rule 206(4)-7(b). The rule requires the annual review but does not prescribe a particular format or require an outside reviewer. The 2023 amendment that would have required written documentation of the annual review was vacated. Rule 204-2(a)(17)(ii), however, requires advisers to make and keep records documenting the review, and the firm’s own procedures may require a written report, checklist, or specified workpapers. (Risk Alert at 5; 17 C.F.R. §§ 275.204-2(a)(17)(ii), 275.206(4)-7(b).)

When Is a Newly Registered Investment Adviser’s First Annual Review Due?

The staff’s September 2026 Risk Alert identifies first reviews conducted 18 months after SEC registration as deficient and explains that the 18-month period discussed in the 2003 adopting release was limited to the original 2004 transition. Newly registered advisers should therefore place the first review on an annual schedule. (Risk Alert at 2 & n.8.)

When Should an Investment Adviser Conduct an Interim Compliance Review?

Rule 206(4)-7 does not prescribe a separate interim-review schedule. The Risk Alert restates the Commission’s 2003 guidance that advisers should consider an interim review in response to significant compliance events, changes in business arrangements, or regulatory developments. An interim review supplements, rather than replaces, the annual review. (Risk Alert at 1 & n.5.)

About Robert Moreiro

Robert Moreiro is a Securities Regulation Partner with Practus, LLP. He has more than 20 years of experience advising broker-dealers, registered investment advisers, financial institutions and associated persons on securities regulation, compliance, regulatory examinations, investigations and enforcement matters. He previously served as Senior Counsel in FINRA’s Enforcement Department and has served as Chief Compliance Officer and AML Compliance Officer for regulated financial-services firms. He is recognized in the 2025 and 2026 editions of The Best Lawyers in America for Securities Regulation and holds the Investment Adviser Certified Compliance Professional and Certified Securities Compliance Professional designations.