SEC Risk Alert: 6 Annual Compliance Review Mistakes That Examiners Keep Finding

Oct. 26, 2026

SEC Risk Alert: 6 Annual Compliance Review Mistakes That Examiners Keep Finding

Oct. 23, 2026

Decoding the SEC Cybersecurity Document Request: What Examiners Hunt For First

Oct. 07, 2026

RIA Valuations in 2026: How to Maximize Your Sale Price in a Cooling Market

Sep. 17, 2026

SEC Exam Priorities for Q4 2026: Reg S-P, Alt Investments & AI

Sep. 03, 2026

Should financial advisors resign while under investigation? (What Actually Happens)

Michelle Atlas-Quinn, J.D.

As Vice President of RIA Operations, Michelle Atlas-Quinn, J.D., is an accomplished legal professional who is dedicated to helping our clients navigate the complex regulatory environment with confidence. Michelle brings a rare combination of legal acumen and extensive industry experience, having previously worked as a licensed attorney and a FINRA-licensed securities principal. This dual perspective provides a deep, practical understanding of compliance, regulatory matters, and risk management within the wealth management sector. Her focus is on translating complex legal requirements into clear operational strategies, providing our RIA clients with top-tier support and guidance. Michelle earned her Juris Doctorate from the University of Denver Sturm College of Law and holds a Bachelor of Arts in Philosophy from the University of Colorado.

On September 14, 2026, the SEC’s Division of Examinations published a Risk Alert on annual compliance reviews under Rule 206(4)-7 of the Investment Advisers Act of 1940—the rule that requires every registered investment adviser to review its compliance program at least once a year. Most firms know they’re supposed to do this. Fewer can prove they did it well or that the problems they found ever got fixed.

Below is a breakdown of the six deficiency areas the Division identified, what they mean in practice, and how to check your own firm against them, including a free, downloadable self-audit checklist at the end.

1. Timeliness: Reviews Have To Actually Happen Every Year

Examiners found firms with gaps between review years, reviews that stretched past the 12-month mark, and in some cases, firms substituting compliance training or employee attestations for an actual annual review. The Division also flagged repeat offenders: firms that had already been cited for timeliness issues in a prior exam and hadn’t fixed it.

What To Check: Do you have a documented review for every calendar year, with clear start and end dates, and no gaps?

2. Completeness Of Review Procedures

Having a policy that says you’ll do an annual review isn’t the same as having procedures that tell your team how. Examiners found firms without clear guidance on testing methodology, what factors to evaluate, or what documentation to produce.

What To Check: If a new compliance hire ran your annual review tomorrow with no institutional memory, could they follow your written procedures and produce a defensible result?

3. Consistency With Your Own Written Procedures

Some firms did the review on time but didn’t follow their own playbook. Examiners cited firms that skipped the defined scope, didn’t use the work papers their own procedures required, or reviewed an outdated version of their own policies.

What To Check: Pull your procedures manual and your last review, side by side. Did the review actually follow what’s written? Was it reviewing the current version of your policies, not last year’s?

4. Policies vs. Actual Practice

Annual reviews frequently missed real gaps between what the firm’s policies say and what the firm actually does, including:

fee and expense billing that didn’t match client disclosures or advisory agreements
proxy voting practices that didn’t reflect stated policy
custody procedures missing steps to flag accounts subject to surprise examination
marketing policies never updated for the Advisers Act marketing rule
filing procedures not updated for Form CRS
third-party delegation without real oversight procedures behind it

What To Check: For each policy area above, ask whether it was actually tested against practice in your last review, or just read and re-filed.

5. Documentation: If It’s Not Retained, It Didn’t Happen

Firms did the work (testing, findings, corrective action notes) but didn’t retain it as required under Rule 204-2(a)(17)(ii). Some firms had policies requiring a written annual review report, but they never actually produced one.

What To Check: Can you pull your annual review file for the last three years, complete with testing records and a written report, on short notice?

6. Corrective Actions: Identifying A Problem Isn’t Fixing It

Some firms’ written reports said that corrective actions had already been taken, when the underlying issue was still there.

What To Check: Take your last two years of review findings. For each one, can you point to the specific date and action that closed it out?

Get Ahead Of Your Next Exam

These six areas are now a known roadmap for what examiners will probe. The firms most exposed aren’t the ones with the messiest compliance programs—they’re the ones that assumed their annual review was fine, because no one had checked closely.

Two resources to help you check now, before an examiner does:

→ [Download our free Annual Review Self-Audit Checklist]: a checklist we built, drawn directly from the six deficiency areas above, so you can walk through your own program, section by section.

→ [Watch: Preparing for an SEC Exam and 2026 Exam Priorities]: a webinar video that also qualifies for IAR CE credit, covering what examiners are prioritizing this cycle.

→ [Download our free Annual Review Self-Audit Checklist]: a checklist we built, drawn directly from the six deficiency areas above, so you can walk through your own program, section by section.

→ [Watch: Preparing for an SEC Exam and 2026 Exam Priorities]: a webinar video that also qualifies for IAR CE credit, covering what examiners are prioritizing this cycle.

If your self-audit turns up gaps that you’re not sure how to close, reach out. This is exactly the kind of work we help advisory firms through, whether you’re a solo RIA or managing a multi-billion-dollar practice.

Frequently Asked Questions

What is Rule 206(4)-7? Rule 206(4)-7 of the Investment Advisers Act of 1940 requires every SEC-registered investment adviser to adopt written compliance policies and procedures, designate a chief compliance officer, and review the adequacy and effectiveness of that program at least once a year.

What did the SEC’s September 2026 Risk Alert on annual reviews find? The SEC’s Division of Examinations found six recurring problems in how firms conduct their annual compliance reviews: late or skipped reviews, incomplete review procedures, reviews that ignored the firm’s own written procedures, policies that no longer matched actual practice, missing documentation, and corrective actions that were identified but never implemented.

How often does an RIA need to conduct an annual review under Rule 206(4)-7? At least once every 12 months, with no gaps between review periods. Substituting compliance training or employee attestations for the actual review does not satisfy the rule.

What records does a firm need to keep from its annual review? Under Rule 204-2(a)(17)(ii), firms must retain the testing records, findings, and corrective action recommendations generated during the annual review as part of their books and records, along with a written report if firm policy requires one.

This post is for general informational purposes and isn’t legal advice. If you have specific compliance questions, consult qualified counsel.

Engage with our experts today!

SEC & State | Compliance Blog Contact

First Name

Email Address

CRD/IAPD #

How Can We Help You?

Last Name

Firm Name

Phone

How Did You Find Us?

Please specify which AI:

Questions or Comments

By providing a telephone number and submitting this form you are consenting to be contacted by SMS text message. Message & data rates may apply. You can reply STOP to opt-out of further messaging. Read our Privacy Policy for more information.