The U.S. Securities and Exchange Commission’s Division of Examinations (the “Division”) is putting renewed attention on how registered investment advisers (RIAs) conduct and document their annual compliance reviews.
In a Risk Alert published on September 14, 2026, the Division outlined recurring deficiencies identified during examinations of investment advisers. While the observations do not create new regulatory requirements, they provide RIAs with a useful roadmap for evaluating whether their annual review process meets regulatory expectations.
Under Rule 206(4)-7 of the Investment Advisers Act, SEC-registered investment advisers must review their compliance policies and procedures at least annually to determine whether they remain adequate and are being implemented effectively. The review should consider compliance matters that arose during the previous year, changes to the firm’s business and relevant regulatory developments. For RIAs preparing for their next annual review or SEC examination, the Risk Alert highlights several areas that deserve closer attention.
Six Areas Drawing SEC Attention
1 | Reviews are not completed annually: Examiners identified firms that skipped review years or allowed more than 12 months to pass between reviews. In some cases, firms treated employee training or annual compliance attestations as substitutes for a substantive annual review.
2 | Policies do not explain how reviews should be conducted: Some compliance manuals stated that an annual review would occur but did not establish procedures for actually conducting one. Firms should consider whether their policies clearly address areas such as testing, documentation, evaluation criteria and responsibility for completing the review.
3 | Firms do not follow their own procedures: Having an annual review process on paper is not enough. Examiners found firms that failed to complete testing, workpapers or other steps required by their own compliance manuals. In other instances, advisers reviewed outdated policies rather than those currently in effect.
4 | Written policies do not match actual practices: This was one of the broader areas identified by the Division. Examiners found inconsistencies involving fee and expense billing, proxy voting, custody, marketing, regulatory filings and third-party oversight.
These findings reinforce an important purpose of the annual review to determine whether the compliance program still reflects how the firm operates today. As services, technology, personnel, vendors and business practices change, compliance policies and procedures need to keep pace.
5 | Annual review documentation is incomplete: Examiners found firms that conducted testing or identified compliance issues but did not maintain supporting records. Others failed to complete or retain reports, checklists and workpapers required by their own policies.
Documentation can be particularly important during an examination. Firms should be prepared to demonstrate what was reviewed, what testing was performed, what issues were identified and what actions resulted from the review.
6 | Corrective actions are not completed: Identifying a compliance issue is only the first step. The Division found advisers that recommended corrective measures during annual reviews but failed to implement them. In some cases, firms reported that an issue had been corrected even though examiners found the problem continued.
What RIAs Should Consider Before Their Next Review
The Risk Alert provides an opportunity for firms to take a closer look at the effectiveness of their own annual review process. RIAs should consider whether reviews are being completed on time and in accordance with the firm’s written procedures. Firms should also evaluate whether testing covers the risks relevant to the business today, whether written policies align with actual practices and whether documentation is sufficient to demonstrate the work performed.
Just as importantly, firms need a process for tracking issues identified during the review. Assigning responsibility, establishing deadlines and confirming that corrective measures have been implemented can help ensure findings do not simply carry forward from one review period to the next. It is important to note that the annual review should not be viewed as a once-a-year compliance exercise. Significant changes to the business, regulatory developments or compliance events may warrant additional reviews between annual cycles.
What This Means for Your Compliance Program
The SEC’s observations reinforce that an annual review should be more than a compliance exercise completed once a year. It is an opportunity to assess whether the compliance program has kept pace with the firm and whether it can stand up to regulatory scrutiny.
For RIAs, that makes the annual review an important part of maintaining an effective compliance program throughout the year. Issues identified during the process can point to broader areas that require attention, while changes to the business or regulatory environment may signal that policies and procedures need to evolve before the next annual review.
Pillar Compliance Group works with investment advisers to conduct annual compliance reviews, evaluate policies and procedures, identify potential gaps and prepare for SEC examinations. An independent perspective can help firms identify areas that may be overlooked internally and take action before they become examination findings.