The SEC's Risk Alert on Annual Compliance Reviews: More Than a Calendar Exercise
By: Jacob Atkinson, Compliance Manager, IACCP®
Background
The SEC's Division of Examinations recently published a Risk Alert on September 14, 2026, highlighting deficiencies identified during examinations of investment advisers' annual compliance reviews. While advisers have long been required under Rule 206(4)-7 to review the adequacy of their compliance policies and procedures at least annually, the SEC's observations suggest many firms are still encountering challenges in applying those requirements.
Rather than simply summarize the deficiencies identified by the SEC, this article focuses on several broader themes that run throughout the Risk Alert. Viewed collectively, the SEC's observations highlight the importance of treating the annual review as an ongoing process, one that begins with understanding how the business has evolved, continues through testing and documentation, and concludes with corrective action where improvements are needed.
Building an Annual Review That Actually Works
A consistent theme throughout the Risk Alert was the gap between conducting an annual review and conducting a meaningful one. SEC staff observed firms that completed reviews but failed to identify material weaknesses, align policies with actual business practices, maintain adequate documentation, or implement corrective actions for known issues.
A strong annual review should answer four basic questions:
Are our policies still appropriate for the business we operate today?
Are we actually following those policies?
Have we documented sufficient evidence to support our conclusions?
Are identified issues being remediated and tracked to completion?
Create a Business Change Inventory
An annual review often starts with testing. Long before getting there, however, firms should be paying attention to how the business is evolving. New services are introduced, vendors are engaged, personnel changes occur, and regulatory requirements continue to develop. The SEC observed that these types of developments were not always reflected in advisers' assessments of their compliance programs.
Consider maintaining a simple planning worksheet throughout the year to capture significant business, operational, and regulatory changes. Keeping this inventory current can make the annual review more effective and reduce the likelihood that important developments are overlooked when evaluating the compliance program.
The goal is not simply to identify what changed during the year. The goal is to determine whether those changes created new risks, required updates to policies or disclosures, or warranted additional testing. By the time many firms begin preparing their annual review, months may have passed since a new vendor was engaged, a policy was updated, a new service was launched, or a regulatory development required action. The underlying work was completed, but the details are often spread across policies, testing files, meeting notes, and other records. Maintaining a simple planning worksheet throughout the year can serve as a running record of those developments, making it easier to translate a year's worth of activity into a thoughtful annual review. Rather than starting with a blank page and relying on memory, firms can begin with a documented history of the changes that shaped their compliance program throughout the year.
Don't Confuse Reviewing with Testing
The annual review may confirm what the firm already believes: its policies are being followed and its controls are working. But a conclusion, no matter how well informed, is only as persuasive as the evidence behind it. The SEC’s observations show why that distinction matters. Staff identified instances in which required testing was not performed, prescribed workpapers were incomplete, or documentation supporting the review was not maintained. In other cases, the process relied on discussion or representations where documented testing was needed. The lesson is not to create paperwork for its own sake, but to ensure that each conclusion in the annual review can be traced to work that supports it.
As you prepare for the annual review, identify the conclusions the firm is making about the effectiveness of its controls and ensure there is sufficient documentation to support those conclusions.
Thorough documentation typically includes:
Scope of review
Findings identified
Areas tested
Recommendations made
Samples selected
Corrective actions completed
Findings Require Follow-Up
The easiest day to address a compliance issue is the day it is identified. Each day after that, competing priorities have a way of pushing it further down the list. The SEC's observations suggest that this challenge is not uncommon. Staff identified advisers whose annual reviews noted needed improvements to policies, disclosures, testing procedures, and business practices, yet those recommendations were never implemented. In some cases, firms reported that corrective actions had been completed even though the underlying issues remained.
A finding is not the end product of an annual review. It is the starting point for improving the firm's policies, procedures, controls, and practices. When reviewing prior findings, consider:
Were the recommended changes implemented?
Were policies, disclosures, or procedures updated?
Were employees trained on the changes?
Conclusion
The SEC's observations highlight asimple reality: an annual review is more than a regulatory requirement. It is one of the few opportunities’ firms have each year to step back and evaluate whether their compliance program still reflects the business they operate, the risks they face, and the regulatory environment surrounding those activities.
A meaningful annual review should challenge assumptions, verify that controls are functioning as intended, and identify where improvements are needed. Just as importantly, it should result in action. Policies should be updated when business practices change, testing should support conclusions, documentation should support testing, and identified issues should lead to improvements.
Ultimately, the strongest annual reviews are not the longest or most detailed. They are the reviews that help firms better understand their risks, strengthen their controls, and continually improve their compliance programs. The SEC's message is clear: the value of an annual review is not that it was completed, but that it meaningfully assessed the effectiveness of the firm's compliance program and drove improvements where needed.