MAK & Associates is a Mumbai-based regulatory compliance consulting firm, founded in July 2017, delivering specialised SEBI compliance services, SEC RIA compliance consulting, corporate secretarial services, and end-to-end legal and compliance advisory for financial service firms in India and globally.
US SEC COMPLIANCE
For SEC-registered investment advisers (“RIA(s)” or “Adviser(s)”), maintaining a compliance manual is only one component of an effective compliance program. Equally important is periodically evaluating whether the policies and procedures remain appropriate for the firm’s business and whether they are being implemented effectively.
In its September 14, 2026 Risk Alert, the U.S. Securities and Exchange Commission’s (SEC) Division of Examinations described weaknesses identified while examining Advisers’ annual compliance review practices.1
Does an Adviser’s annual compliance review provide meaningful assurance about its compliance framework, or has it become primarily an administrative exercise?
The Risk Alert does not amend the Compliance Rule. Instead, the SEC examination examples show how weaknesses may arise between an Adviser’s documented review process and the work carried out in practice.
For Advisers, this places emphasis on the review process as a whole: identifying the appropriate areas to assess, performing the necessary work, retaining supporting evidence, and addressing the issues identified.
Rule 206(4)-7 under the Investment Advisers Act of 1940 (“the Compliance Rule”) requires RIAs to adopt and implement written compliance policies and procedures reasonably designed to prevent violations of the Advisers Act and applicable rules.
The rule also requires Advisers to review, at least annually, both:
The SEC’s original adopting release explains that reviews should consider compliance issues arising during the preceding year, developments in the Adviser’s or its affiliate’s business, and relevant regulatory changes.2
Importantly, the review should reflect the Adviser’s particular operations, business model, investment strategies, clients, and associated risks.
A compliance framework appropriate for a wealth management adviser serving retail clients may differ substantially from that of an institutional investment manager or private fund adviser. The September 2026 Risk Alert reinforces this risk-based approach.
SEC examination staff identified instances where Advisers failed to complete reviews within the required annual cycle, omitted particular review periods, or allowed extended intervals following operational changes or departures of compliance personnel.
The staff also encountered Advisers treating compliance training sessions or annual employee attestations as substitutes for conducting a substantive review.
Although such activities may contribute to a compliance program, they do not, by themselves, establish that the Adviser has assessed the adequacy and effectiveness of its policies and procedures.
Another recurring weakness involved Advisers whose compliance manuals required specific testing, validation, workpapers, or review activities without clearly explaining how personnel should undertake those assessments.
In other cases, the Adviser had established procedures but failed to follow them.
For example, a policy might prescribe testing of particular operational activities, yet the annual review may omit the relevant testing or rely on outdated versions of the firm’s compliance documents.
These observations demonstrate the importance of consistency between what the compliance manual requires and what the review actually accomplishes.
The Risk Alert also highlights instances where an Adviser’s written policies failed to correspond with its actual business activities.
Examples included discrepancies involving advisory fee calculations, proxy voting arrangements, custody-related procedures, marketing practices, regulatory filing requirements, and oversight of delegated functions.
These findings illustrate a broader compliance concern: a policy can appear adequate on paper while failing to address how the business operates in practice.
An effective annual review should therefore examine not only whether the firm has adopted a policy, but whether the policy accurately reflects its activities and sufficiently addresses relevant risks.
SEC examination staff observed Advisers that prepared testing documentation, identified deficiencies, or recommended corrective action but failed to maintain the corresponding records.
Other Advisers identified compliance weaknesses without implementing the recommended changes.
In certain cases, previously identified deficiencies continued despite written reports suggesting that corrective measures had been completed.
This creates a distinction between recording a compliance concern and demonstrating that it has been appropriately resolved.
Taken together, these findings suggest that an effective annual review should connect risk assessment and compliance testing with supported conclusions and appropriate follow-up on identified deficiencies.
An annual review is most valuable when it provides the Adviser with a practical assessment of its regulatory risk exposure and the effectiveness of its internal controls.
In our view, Advisers should consider organizing their review methodology around four interconnected elements:
Risk identification. Determine whether the firm’s compliance risk assessment remains aligned with its investment strategies, client base, service providers, conflicts of interest, operational structure, and regulatory obligations.
Control testing. Assess whether the policies and procedures are being implemented consistently. Depending on the firm’s activities, this may involve reviewing transaction records, fee calculations, personal trading records, marketing materials, regulatory filings, or other relevant supporting documentation.
Evidence and reporting. Maintain sufficient records to explain the review’s scope, procedures performed, observations, and conclusions. The nature and extent of documentation should be proportionate to the Adviser’s operations and consistent with its adopted procedures.
Remediation and follow-up. Assign responsibility for deficiencies, establish reasonable completion targets, and evaluate whether corrective measures were implemented effectively.
The SEC’s previously published examination guidance offers useful context. It indicates that the SEC examination staff may evaluate who conducted an annual review, what was reviewed, the methodology used, the findings and recommendations, and the status of corrective action.3
Advisers may benefit from examining how their existing annual review arrangements address the following considerations.
Review area | Practical consideration |
Review planning | Is the review appropriately scheduled, scoped, and assigned? |
Regulatory changes | Have relevant legal developments and changes in business activities been incorporated? |
Compliance testing | Does the methodology include appropriate testing of material risks and applicable controls? |
Records and documentation | Can the adviser substantiate the review work performed and conclusions reached? |
Corrective action | Are identified deficiencies tracked through appropriate resolution and verification? |
Management oversight | Are significant compliance issues appropriately communicated and escalated? |
These considerations are not a prescribed SEC checklist. Rather, they represent a practical framework for evaluating the quality and consistency of an Adviser’s annual review process.
For Advisers with operations across multiple jurisdictions, additional attention may be appropriate where investment management, research, operations, technology, or compliance functions are performed by geographically dispersed personnel or affiliates.
Such arrangements may warrant particular consideration of accountability, communication, delegated responsibilities, and the availability of supporting records.
The relevant question is not where the Adviser is headquartered, but whether its compliance arrangements adequately address the activities and risks associated with its SEC-registered advisory business.
Advisers should distinguish between the obligation to conduct an annual compliance review and the requirements relating to documentation.
In 2023, the SEC adopted amendments that would have expressly required registered Advisers to document their annual compliance reviews in writing. However, those amendments were vacated by the U.S. Court of Appeals for the Fifth Circuit in June 2024 and are no longer in effect.4
Accordingly, Rule 206(4)-7 does not currently impose a standalone requirement to prepare a particular form of written annual review report.
Nevertheless, Rule 204-2(a)(17)(ii) continues to require Advisers to maintain records documenting their annual reviews that they create, and Advisers must comply with their own adopted documentation procedures.
Preparing a well-supported written record remains a prudent compliance practice, particularly where an Adviser may need to demonstrate the scope and effectiveness of its review during an SEC examination.
Advisers should also recognize that the Compliance Rule does not generally require annual reviews to be conducted by an independent external auditor. Appropriate internal personnel may conduct the review, with external assistance where useful.
The September 2026 Risk Alert provides an opportunity for investment advisers to reassess whether their annual review processes are sufficiently tailored, consistently implemented, and supported by reliable evidence.
Advisers should consider reviewing their annual compliance review methodology before the next scheduled review, rather than waiting until an examination identifies weaknesses.
This may include revisiting compliance risk assessments, updating testing procedures, strengthening documentation practices, and ensuring that previously identified deficiencies have been appropriately addressed.
Ultimately, the effectiveness of a compliance program depends not simply on the existence of written policies but on the Adviser’s ability to demonstrate that those policies remain relevant, are operationally effective, and respond appropriately to identified compliance risks.
An annual compliance review should therefore be viewed not merely as a regulatory obligation, but as an opportunity to strengthen internal governance, support regulatory preparedness, and promote a more sustainable compliance framework.
MAK & Associates is a Mumbai-based regulatory compliance consultancy providing advisory and support services relating to SEC investment adviser compliance, including compliance policies and procedures, annual review support, regulatory filings, and examination readiness.
For assistance with SEC compliance requirements or to discuss your firm’s compliance support needs, please visit www.maknassociates.com.
Additional reference: U.S. Securities and Exchange Commission, Division of Examinations, Investment Advisers: Assessing Risks, Scoping Examinations, and Requesting Documents, Risk Alert, September 6, 2023.
Disclaimer: This article is intended for general informational purposes and does not constitute legal advice or a firm-specific compliance assessment. Regulatory requirements should be evaluated in light of each adviser’s circumstances and applicable law.
About The Author
Kiran Krishnan is the Co-Founder and Principal Consultant of MAK & Associates, a Mumbai-based legal and compliance firm. Kiran is a regulatory compliance professional with 9 + years of experience across SEC (US) and SEBI (India) frameworks, including advising SEC-registered investment advisers on mock examinations, annual reviews, and regulatory filings.
The views expressed here are his personal views.
