The SEC's annual review alert: can you show what changed?

An annual compliance review can be completed on time and still leave an important question unanswered: what did the firm test, what did it find, and what happened next?

On September 14, the SEC's Division of Examinations published a risk alert on investment adviser annual compliance reviews. It draws on examination observations under Advisers Act Rule 206(4)-7. The alert does not create a new requirement. It describes weaknesses staff has seen in the way some SEC-registered advisers conduct, document, and follow through on reviews that the rule already requires.

For a chief compliance officer, the practical question is less about producing another annual document and more about being able to trace a concern from the underlying activity to the review, a decision, and any resulting change.

What the staff observed

The risk alert identifies five recurring areas:

1. Timing. Some advisers missed a review year, allowed more than 12 months between reviews, or treated training and employee attestations as substitutes for the annual assessment.
2. Review procedures. Some policies required testing but did not explain how personnel should perform it, evaluate results, or retain supporting records. In other cases, topics called for elsewhere in the firm's policies were omitted from the annual review.
3. Alignment with actual practice. Some reviews did not follow the firm's own stated scope or tests, relied on superseded policies, or missed differences between written procedures and how the business operated.
4. Records. Some firms discussed violations or recommendations in an annual report without retaining the testing records and other materials generated during the review. Others failed to prepare a report their own procedures required.
5. Corrective action. Some reviews recommended changes that were never made, including cases where a report said action had been completed but the issue persisted.

The examples are specific. Staff described fee practices that differed from policies or client disclosures, proxy-voting statements that conflicted with what firms did, and incidents reported during the year that were not reflected in the annual review. These are illustrations from examinations, not a universal checklist for every adviser.

A more useful way to prepare the review

The alert suggests a straightforward internal test: select a significant issue from the review period and try to reconstruct its path without relying on anyone's memory.

Can you locate the original observation or source record? Can you see who assessed it and against which policy or disclosure? Does the annual review show the conclusion reached? If a change was recommended, is there evidence that it was assigned, made, and checked?

Apply the same test to changes in the business. A new service, affiliate arrangement, communication channel, or vendor may affect the review's scope. The annual review should reflect the firm's actual risks and operations rather than repeat last year's headings by default. The SEC staff also points to the potential need for interim reviews after significant compliance events, business changes, or regulatory developments.

For a small team, the aim is a defensible record, not a larger binder. A focused review can preserve the workpapers, link them to findings, record decisions, and show which actions closed. Its design should follow the firm's own activities and written procedures.

The ComplyVault implication

ComplyVault's focus is the connective tissue between a source, a review decision, and the record of how it was handled. When communication or meeting evidence raises a question, a compliance team should be able to bring the relevant source into view, record its assessment, and track the resulting action. Those records can help inform an annual review; the CCO still owns the judgment, scope, and conclusions.

The SEC's alert is a timely prompt to ask: if an examiner chose one issue from last year's review, could we show the full path from discovery to resolution?

Source: SEC Division of Examinations, Examinations Observations Regarding Investment Adviser Annual Compliance Reviews, September 14, 2026. The alert states that it reflects staff views, has no legal force or effect, and creates no new obligations.