SEC Risk Alert Highlights the Importance of the Annual Review
On September 14, 2026, the SEC's Division of Examinations issued a Risk Alert on investment adviser annual compliance reviews. Rule 206(4)-7 under the Advisers Act requires that registered investment advisers review their written policies and procedures on at least an annual basis to assess their adequacy and the effectiveness of their implementation. The Risk Alert describes six categories of deficiencies that SEC examiners have observed:
Timeliness, including gaps in the adviser’s annual reviews and annual reviews that covered periods of more than 12 months. The Risk Alert notes that some of these firms engaged in recidivist conduct by failing to address prior deficiencies from SEC examination staff related to the firm’s annual reviews.
Incomplete procedures for the annual review, including procedures that provided inadequate guidance for testing, evaluating whether policies and procedures were adequate or implemented effectively, and documentation of the annual review.
Not following written procedures, including reviews that deviated from the review period, scope, or other requirements set forth in the adviser’s policies and procedures as well as reviews that assessed the effectiveness of outdated policies and procedures that had been superseded prior to the review period.
Failure to recognize that procedures were not aligned with practice, including that key risk areas were not addressed in the adviser’s written policies and procedures as well as instances in which changes in the adviser’s business were not considered during the review.
Inadequate documentation, including failure to maintain documentation of the annual review itself as well as documentation related to violations and other issues identified by the review. The Risk Alert also notes that certain deficiencies were the result of an adviser failing to follow its own policies and procedures regarding the manner in which the review should be documented (e.g., using specific templates, checklists, or workpapers that were not completed or only partially completed).
Lack of corrective action, where the adviser failed to address deficiencies identified by the annual review, including certain instances in which the documentation of the annual review erroneously stated that corrective action had been taken.
This Risk Alert serves as an important reminder that the SEC expects advisers to take the annual review seriously and that it cannot be approached as a check-the-box exercise. With the end of the calendar year rapidly approaching, all advisers should take this opportunity to reassess their annual review process and related policies and procedures in light of the Risk Alert.