The Annual Review Mandate
Rule 206(4)-7 under the Investment Advisers Act requires SEC-registered investment advisers to adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and rules thereunder. The rule also mandates that advisers review those policies and procedures at least annually to determine their adequacy and effectiveness. This annual review represents one of the most critical compliance obligations for registered investment advisers.
The Chief Compliance Officer typically conducts the annual review, though the CCO may delegate specific testing and evaluation tasks to qualified staff while maintaining ultimate responsibility for the process and results. The review must be documented in writing, and results must be presented to senior management or the board. This documentation serves as evidence during SEC examinations that the firm takes compliance seriously and continuously evaluates program effectiveness.
An effective annual review goes beyond checking boxes to provide genuine assessment of whether compliance policies match business practices, whether procedures are being followed consistently, whether new risks have emerged requiring policy updates, and whether the firm's compliance culture supports adherence to ethical standards and regulatory requirements.
Planning and Scoping the Annual Review
Successful annual reviews begin with careful planning well before year-end. The CCO should establish a timeline allocating adequate time for each review component, typically beginning two to three months before the review deadline. Breaking the review into manageable phases prevents last-minute rushes and allows thorough evaluation of each compliance area.
The review scope should cover all material aspects of the compliance program including policies and procedures in each required area, implementation and adherence to established policies, books and records maintenance and accessibility, Form ADV accuracy and completeness, fiduciary duty fulfillment, marketing and advertising practices, custody and client asset protection, personal securities trading and conflicts of interest, and cybersecurity and business continuity preparedness.
Risk-based approaches allow CCOs to allocate review time proportionate to areas of greatest compliance concern. Higher-risk activities such as performance advertising, third-party solicitation arrangements, complex fee structures, or custody situations warrant more extensive testing. Lower-risk areas may receive lighter review, though no compliance area should be completely ignored simply due to perceived low risk.
Reviewing Policies and Procedures
The foundation of the annual review involves assessing whether written policies and procedures remain adequate given current business activities, regulatory requirements, and risk profile. The CCO should review each policy section systematically, asking whether policies accurately describe current practices, whether new business activities require new or modified policies, whether regulatory changes since the last review necessitate policy updates, and whether identified compliance issues during the year suggest policy deficiencies.
Common areas requiring policy updates include changes to advisory services or client types served, new marketing channels or social media platforms utilized, modifications to fee structures or billing practices, changes in custody arrangements or service providers, new third-party relationships requiring due diligence, implementation of new technology systems handling client data, and evolving cybersecurity threats requiring enhanced controls.
The review should identify policies that exist only on paper without genuine implementation. Compliance manuals containing policies that don't reflect actual business practices create examination risk and provide no real compliance value. When policies don't match practices, the CCO must determine whether to update policies to reflect actual operations or modify operations to match existing policies.
Testing Policy Implementation and Adherence
Beyond reviewing written policies, annual reviews must evaluate whether policies are being followed in practice. Compliance testing involves selecting samples of transactions, activities, or records and examining whether they comply with established policies. Testing methodologies vary by compliance area but generally include sampling personal securities transactions for compliance with preclearance and reporting requirements, reviewing fee billing calculations against client agreements and Form ADV disclosures, examining marketing materials for required disclosures and approval documentation, testing trade allocations for fairness and consistency with allocation policies, and reviewing client communications for suitability and adherence to standards.
Sample sizes should be sufficient to provide reasonable confidence in testing results while remaining practical given firm resources. For smaller advisers with limited transactions, testing larger percentages of activity may be necessary. Larger firms may use statistical sampling techniques to test representative portions of high-volume activities. When testing identifies violations or deficiencies, the CCO should investigate root causes and determine whether issues are isolated or systemic.
Documentation of testing procedures and results is essential. Testing workpapers should identify what was tested, sample selection methodology, findings, and any corrective actions taken. This documentation demonstrates to regulators that the annual review involved substantive evaluation rather than superficial assessment.
Form ADV Accuracy Review
Annual reviews should include comprehensive evaluation of Form ADV accuracy and completeness. The CCO should verify that Form ADV Part 1 responses accurately reflect current business operations, ownership, clients, employees, and business practices. Key areas include assets under management calculations using proper methodologies, advisory business description matching current services and strategies, fee schedule accuracy compared to actual billing practices, custody responses consistent with actual custody arrangements, and disciplinary disclosure completeness covering all reportable events.
Form ADV Part 2A brochure review should confirm that all material information about advisory services, fees, conflicts, and disciplinary history is disclosed accurately and clearly. The brochure should be written in plain English understandable to retail clients and avoid jargon or overly technical language. Particular attention should focus on whether fee disclosures match actual billing practices including all fees charged to clients, whether conflicts of interest section identifies all material conflicts inherent in the business model, whether disciplinary disclosures cover required events for the firm and supervised persons, and whether service descriptions accurately represent advisory offerings.
Form ADV Part 1 and Part 2 consistency should be verified. Discrepancies between the two parts can indicate errors or suggest areas requiring clarification. For example, if Part 1 indicates the adviser provides financial planning services but Part 2 focuses exclusively on investment management, this inconsistency warrants investigation and correction.
Books and Records Compliance Assessment
The annual review should evaluate books and records systems for compliance with Rule 204-2 requirements. The CCO should confirm that all required record categories are being created and maintained, records are preserved for required retention periods, electronic storage systems meet regulatory specifications for non-rewriteable formats, records are readily accessible and producible upon regulatory request, and backup systems protect against record loss or destruction.
Common recordkeeping deficiencies include incomplete email archiving missing certain accounts or platforms, inadequate retention of marketing materials and social media posts, missing or incomplete trade documentation for certain account types, gaps in personal securities transaction records for supervised persons, and insufficient documentation of compliance testing and annual review activities.
Testing should include attempting to retrieve various record types to confirm accessibility. If records cannot be located promptly or systems make retrieval cumbersome, improvements are needed before an SEC examination. Remember that regulators expect records to be easily accessible, meaning producible within a reasonable timeframe during examinations.
Conflicts of Interest Evaluation
Annual reviews must assess how the adviser identifies, discloses, and manages conflicts of interest. The CCO should inventory all material conflicts inherent in the business including compensation arrangements creating incentives to recommend certain products, proprietary product recommendations, affiliated service provider relationships, principal trading or cross trading between clients, allocation of limited investment opportunities, soft dollar arrangements, and compensation from third parties for client referrals.
For each identified conflict, the review should confirm adequate disclosure in Form ADV Part 2A and client communications, implementation of controls mitigating conflict impacts where appropriate, monitoring of activities presenting conflicts, and periodic assessment of whether conflicts have increased or changed requiring disclosure or control updates.
New conflicts may emerge as business practices evolve. Launch of new services, changes in compensation structures, new vendor relationships, or shifts in ownership can create previously non-existent conflicts requiring disclosure and management. The annual review should specifically consider whether business changes during the year introduced new conflicts not yet addressed in policies or Form ADV.
Cybersecurity and Business Continuity Review
Given increasing cybersecurity threats and SEC examination focus on this area, annual reviews should include comprehensive assessment of information security and business continuity preparedness. The review should evaluate implementation of required cybersecurity controls including access controls limiting system access to authorized personnel, encryption of sensitive data in transit and at rest, regular security patching and updates, employee cybersecurity training and awareness, incident response planning and testing, and vendor due diligence for service providers handling client data.
Business continuity plans should be reviewed and tested annually. The review should confirm that plans address various disruption scenarios including office unavailability, technology failures, key personnel absence, and cybersecurity incidents. Testing should verify that critical business functions can continue during disruptions and that communication protocols enable client contact and regulatory notification as required.
Given rapid evolution of cyber threats, annual cybersecurity reviews should consider whether new risks have emerged requiring enhanced controls. Ransomware attacks, phishing campaigns targeting financial services, cloud security concerns, and remote work vulnerabilities all present evolving challenges requiring ongoing attention and control refinement.
Regulatory Developments and Industry Changes
Annual reviews should account for regulatory developments and industry changes occurring during the review period. The CCO should identify new SEC rules, amendments, or guidance affecting advisory operations, new examination priorities or sweep initiatives announced by regulators, enforcement actions providing insight into SEC expectations, and industry best practices emerging from compliance organizations or peers.
Recent years have seen significant regulatory activity including Marketing Rule implementation requiring advertising compliance reviews, Form PF amendments for large private fund advisers, enhanced cybersecurity requirements and examination focus, ESG disclosure and substantiation expectations, private fund adviser rules addressing fees, expenses, and conflicts, and AI governance guidance for advisers using algorithmic tools.
The annual review should assess whether the compliance program addresses new regulatory requirements adequately and whether policies require updates to reflect evolving SEC expectations even when formal rule changes have not occurred.
Documenting Review Results and Reporting
Rule 206(4)-7 requires that annual review results be documented in writing. The CCO's written report should summarize the review scope and methodology, identify material compliance issues discovered during the review, describe policy and procedure changes made or recommended, document testing performed in key compliance areas, assess the overall adequacy and effectiveness of the compliance program, and recommend improvements or enhancements for the coming year.
The report should be presented to senior management, the board of directors, or the firm's governing body. This presentation demonstrates leadership accountability for compliance and ensures resource allocation decisions account for compliance needs. Meeting minutes should document the presentation and any board or management responses to recommendations.
Annual review documentation becomes part of the adviser's books and records subject to SEC examination. Well-documented reviews demonstrating systematic evaluation of compliance effectiveness create favorable impressions during examinations. Conversely, perfunctory or incomplete reviews suggest inadequate attention to compliance obligations.
Implementing Corrective Actions and Improvements
Identifying compliance issues and improvement opportunities provides value only when followed by implementation of corrective actions. The CCO should develop action plans addressing material findings including specific steps required to remediate issues, responsible personnel for each action item, target completion dates, and follow-up procedures to verify completion.
Priority should be given to issues presenting significant compliance or regulatory risk. Material conflicts of interest lacking adequate disclosure, custody compliance gaps, fee billing errors, or marketing violations require immediate attention and remediation. Lower-priority improvements can be scheduled systematically throughout the year.
Progress on corrective actions should be monitored regularly rather than waiting until the next annual review. Quarterly compliance reports to management should track action item completion and escalate delayed items requiring additional resources or attention. This ongoing monitoring ensures the annual review translates into genuine compliance improvements rather than becoming a shelf document.
Key Takeaways
- SEC Rule 206(4)-7 mandates annual review of compliance policies and procedures to assess adequacy and effectiveness, with results documented in writing.
- Effective reviews require advance planning, systematic evaluation of each compliance area, and risk-based allocation of review resources.
- Policy review should confirm written policies match actual business practices and address current regulatory requirements and business risks.
- Compliance testing provides evidence that policies are being followed in practice, not just existing on paper.
- Form ADV accuracy and consistency between Parts 1 and 2 should be verified as part of annual review procedures.
- Books and records systems must be evaluated for compliance with retention requirements and accessibility standards.
- Conflicts of interest inventory should be updated to identify new conflicts emerging from business changes during the year.
- Cybersecurity and business continuity assessments are increasingly important given SEC examination focus and evolving threats.
- Regulatory developments and industry changes must be incorporated into compliance program updates and policy revisions.
- Annual review results must be documented and reported to senior management or the board, with corrective action plans implemented systematically.