What Happened
On September 14, 2026, the SEC's Division of Examinations published a Risk Alert titled 'Examinations Observations Regarding Investment Adviser Annual Compliance Review.' The alert draws directly on what examiners found — and documented — during recent examinations of SEC-registered investment advisers. It is not a rule change and it does not create new legal obligations, but it is as close to a pre-exam briefing as you will ever get from the SEC.
The timing matters. Q4 is the period when most RIAs either finish or schedule their annual compliance review. The Division issued this alert now, which signals that annual reviews will be a live exam topic heading into the next examination cycle.
The Rule in Plain English
Rule 206(4)-7 under the Investment Advisers Act of 1940 requires every SEC-registered investment adviser to: (1) adopt and implement written compliance policies and procedures reasonably designed to prevent Advisers Act violations, and (2) review those policies and procedures at least annually to assess their adequacy and the effectiveness of their implementation. Companion rule Rule 204-2 requires advisers to maintain books and records documenting that review. Both rules have been on the books since their compliance date of October 5, 2004 — the deficiencies the staff is citing are not new requirements. They are longstanding obligations that examiners are still finding firms getting wrong.
The Five Deficiency Categories Examiners Called Out
The Risk Alert organizes staff observations into five recurring problem areas. Read them as a checklist of what examiners will look for when they walk in the door.
1. Timeliness. Staff observed gaps between review years — for example, reviews covering 2021 and 2023 with 2022 skipped entirely — and intervals exceeding twelve months. Extended gaps were often attributed to business, operational, and personnel changes, including CCO departures. The staff's message is unambiguous: changes in personnel or operations are not a sufficient reason to defer the review. Some firms compounded the problem by treating compliance training or annual employee attestations as a substitute for the review itself. The staff confirmed those activities do not satisfy Rule 206(4)-7.
2. Incomplete policies and procedures for conducting reviews. Some advisers maintained policies that required documentation and testing but did not set out the actual direction and processes personnel should follow. Separately, topics that the firm's own policies mandated for annual testing — such as identity theft red-flag policies — were simply excluded from the reviews that were actually performed.
3. Reviews inconsistent with written procedures. Examiners observed reviews that departed from the defined review period or scope, assessed outdated versions of policies rather than current ones, or failed to produce documentation the firm's own written procedures required.
4. Billing and other substantive deficiencies surfaced during reviews. The staff noted billing practices inconsistent with the RIA's policies or its client disclosures in advisory agreements and Form ADV — including fees calculated on a different basis than disclosed, fees not prorated for large deposits made mid-billing period, unapplied fee breakpoints, and refunds not issued on terminating accounts. Proxy voting procedures that committed the firm to vote proxies were maintained by RIAs that had told clients they did not vote proxies. Custody procedures failed to identify client accounts in scope for required surprise audits. And in a particularly notable observation: some firms still maintained marketing procedures drafted to the old advertising and cash solicitation rules that the Advisers Act Marketing Rule (Rule 206(4)-1) consolidated and replaced — compliance with which has been required since November 4, 2022.
5. Documentation and follow-through. Examiners found that identified deficiencies were not consistently recorded, corrective actions were not assigned to responsible parties, and there was no structured process for tracking remediation to completion. Prior exam deficiencies were sometimes left open. The recordkeeping obligation under Rule 204-2 means that 'we fixed it' is not sufficient — you need a record that demonstrates what you found, when, who owned the fix, and that it was resolved.
Why This Alert Is Different From Background Noise
The Division flagged the annual review as a stated 2026 examination priority, and this Risk Alert reinforces that focus. The deficiencies described are not exotic — they are process and documentation failures that examiners can verify quickly by pulling your review files and comparing them to your written policies. That means the exposure surface is large and the examination friction is low. An examiner does not need deep expertise in your investment strategy to check whether your review covered all the topics your own procedures require, whether the interval between reviews exceeded twelve months, or whether a deficiency identified last year has a documented resolution.
The alert also ties directly to the billing, marketing rule, and custody areas that have been recurring examination priorities. If your annual review is not designed to catch fee calculation errors, stale marketing disclosures, or custody scope gaps, the review itself becomes an exam deficiency — separate from the underlying substantive issue.
What to Do Now
The following steps are framed as actions to consider. Where Rule 206(4)-7 or Rule 204-2 mandates a specific action, that is noted explicitly.
Check your calendar — Rule 206(4)-7 mandates at least annual reviews. Confirm the exact date your last review was completed and calculate when the next one is due. If you are within 60 days of the anniversary, start now. If a CCO departure or business disruption has stretched the interval past twelve months, treat that gap as an immediate priority and document the circumstances.
Do not let training or attestations substitute for the review. Employee compliance training and annual attestations are valuable, but they do not satisfy Rule 206(4)-7. The annual review must independently assess both the adequacy of your policies and procedures and the effectiveness of their implementation.
Map your review scope against your written procedures. Pull your policies and procedures for conducting the annual review and compare them line-by-line to the review you actually ran last year. If your procedures require testing of identity theft red-flag policies, AML, or any other specific topic, confirm those items appear in the review record. Gaps between what your procedures promise and what you did are exactly what examiners flag.
Update stale policies and procedures. If your marketing procedures still reference the pre-November 2022 advertising and cash solicitation rules rather than Rule 206(4)-1, update them before your next review. The same applies to any other area where regulations have changed since your procedures were last revised.
Assign owners and deadlines to every open finding. Consider establishing a remediation log that captures each deficiency identified during the review, the person responsible for correcting it, a target completion date, and the date it was actually closed. Rule 204-2 requires you to retain books and records documenting your review — a remediation log is both a compliance tool and an exam-ready record.
Retain all review documentation. Under Rule 204-2, documentation of the Rule 206(4)-7 review must be maintained as part of your books and records. That includes scope memoranda, testing workpapers, findings summaries, and evidence of corrective action — not just a final sign-off page.
Consider including billing, custody, and marketing rule items in your review scope. The substantive deficiencies the staff described — unapplied fee breakpoints, custody scope errors, and stale marketing procedures — are most efficiently caught through a well-scoped annual review. Consider building explicit testing steps for these areas into your review methodology.
Bottom Line
The September 14, 2026 Risk Alert is a clear signal that examiners are going to pull annual review files and grade them against five specific criteria: timeliness, completeness of review procedures, consistency with written procedures, substantive findings, and documented follow-through. None of those criteria require a new compliance program — they require that the program you already have actually runs as written, on schedule, and leaves a paper trail. With Q4 here, now is the right time to close any gap before an examiner does it for you.