Your Annual Compliance Review Is a Stress Test, Not a Report Card

An annual compliance review can satisfy the calendar without satisfying the purpose.

That distinction matters.

The SEC's Division of Examinations' September 14, 2026 Risk Alert on investment adviser annual compliance reviews does not introduce a new requirement, and the staff says so expressly. What it does is give CCOs a useful look at the weaknesses examiners are finding in the review process itself.

The review needs to produce evidence that the compliance program was actually evaluated.

The Review Itself Is Subject to Review

Rule 206(4)-7(b) requires advisers to review, no less frequently than annually, the adequacy of their compliance policies and procedures and the effectiveness of their implementation. Rule 204-2(a)(17)(ii) requires them to keep records documenting that review.

The important word is not "annually."

It is "review."

The Risk Alert shows that examiners are looking at how firms conduct that review, not simply whether someone completed one. Annual and interim reviews, and any reports prepared, are standard items on the examination document request list.

The staff described advisers that skipped years entirely, went more than 12 months between reviews, waited until 18 months after registration to conduct a first review, or treated activities such as employee training and annual attestations as substitutes for the review itself. Some had already received deficiency letters for the same problem.

Those activities may be part of a strong compliance program. They do not demonstrate that the adviser evaluated whether its policies and procedures are adequate or whether they are actually being implemented.

That is a much higher bar than confirming that the annual process occurred.

One thing worth calling out is a CCO turnover. The staff saw reviews slip past 12 months when a CCO left or the business went through other changes. It makes sense. When the person who owns the calendar walks out the door, the calendar tends to go with them. But the clock keeps running.

What Examiners Are Actually Looking At

The Risk Alert organizes its observations around five areas: whether the review was timely, whether the firm had complete procedures for conducting it, whether the review aligned with those procedures and with the firm's actual practices, whether the work was documented and kept, and whether identified issues were corrected.

Together, those areas provide a useful measure of whether the review was substantive.

A firm may have a testing requirement, but if the procedure does not explain how testing should be performed, what factors should drive the conclusion, or what evidence should be retained, the process may exist on paper without producing much insight.

The Risk Alert describes reviews that omitted topics the firm's own manual said would be tested (identity theft procedures, in one example), evaluated superseded versions of policies, skipped the workpapers and checklists the procedures called for, or failed to produce the written report that the firm's own procedures required.

For a CCO, the practical test is straightforward: could someone who was not involved in the review look at the file months later and understand what was actually done and what came out of it?

If not, the documentation may not be doing its job.

Test the Program, Not the Manual

There is a temptation to approach an annual review by starting with the compliance manual and working through it section by section.

That can be orderly. It can also create a false sense of completeness.

A policy can be well written, recently updated, and disconnected from the way a firm actually operates.

The SEC's observations illustrate this. Examiners identified fee billing practices that differed from policies and disclosures (different calculation methods, fees not prorated, breakpoints not applied, refunds not issued), proxy voting policies that promised votes the firm told clients it would not cast, custody procedures that omitted steps for identifying accounts to the surprise examination accountant, marketing procedures that had not been updated for the Marketing Rule, filing procedures that did not account for applicable Form CRS obligations, and delegated functions with no defined oversight.

Notice how examiners found these. The staff often identified the problem first in the firm's business or operations, then went back to the annual review to see whether it had been caught.

That is the stress test in reverse. If the examiner finds the gap before your review does, the review becomes part of the finding.

The problem was not necessarily that the firm lacked a policy.

The problem was the gap between the policy and the operation.

That is what the annual review should expose.

A strong review moves beyond the manual. It examines the controls, people, evidence, and actual practices behind the policy.

It also asks what the manual is missing. The staff observed firms that had not adopted policies for risk areas pivotal to their business.

The goal of the annual review is not to prove that your compliance program works. It is to find out where it doesn't.

Findings Are Where the Review Becomes Valuable

A review that produces findings and then does nothing with them is a problem.

The Risk Alert describes annual reviews that recommended improving proxy voting disclosures, documenting client risk tolerances, and conducting more thorough best execution analysis and broker-dealer due diligence, and firms that never made the changes.

In some cases, the next written annual review report stated that the corrective action had already occurred, even though the issue persisted.

The staff also saw incidents of non-compliance that were identified and reported during the year but never recorded in the annual review. If an issue was significant enough to escalate in March, it belongs in the review.

This is where the annual review becomes a management tool.

A finding should lead to a decision. Maybe the policy needs to change. Maybe the process needs to change. Maybe additional training or supervision is appropriate. Maybe the existing control is adequate and the firm simply needs to document why.

What matters is that the firm considers the finding, determines an appropriate response, assigns responsibility where necessary, and follows through.

The basic chain is simple: finding, decision, action, verification.

Without that chain, the annual review risks becoming a record of observations rather than a mechanism for improving the program.

Documentation Should Tell the Story

The Risk Alert notes instances where firms performed testing, identified violations, and recommended corrective actions, and even discussed them in the annual report, but did not keep the underlying work in their books and records. Others adopted checklists or templates for the review and then completed them only partially.

You may know exactly what you reviewed and why, but an examination does not run on memory.

The file should make the process understandable. It should show the scope of the review, the work performed, the evidence considered, the conclusions reached, and the actions that followed.

A strong annual review leaves behind a record that tells the story without requiring the CCO to reconstruct it months later.

The Annual Review Should Inform Management

The annual review should not be something the CCO completes and then files away.

It should give management a clear assessment of whether the firm's control environment is keeping pace with the business.

Many findings cannot be fixed by compliance alone. Fee, marketing, vendor, and operational issues may require action outside compliance.

The review should make those connections visible to management.

It also works in the other direction. The Risk Alert describes reviews that missed relevant business changes because the CCO was never told about them. Management has to feed the review, not just receive it.

Twelve Months Is Not a Safe Harbor

The annual requirement establishes a floor. It does not mean significant developments should sit untouched until the next review.

When it adopted the Compliance Rule, the SEC said advisers should consider interim reviews in response to significant compliance events, changes in business arrangements, and regulatory developments. The Risk Alert repeats that expectation, and its examples show the cost of waiting: marketing procedures never updated for the Marketing Rule, and filing procedures that missed Form CRS.

If something materially changes the firm's risk profile, waiting for the next annual cycle may not be the best approach.

The strongest annual reviews are the culmination of ongoing oversight, not the first look at the program in twelve months.

Measure the Review by What You Learned

I would measure an annual review by the insight it produces, not its length. A useful review should show what was tested, what the evidence showed, where attention is needed, and what actions follow.

Not every review needs a long list of deficiencies. Sometimes the conclusion is that a control was tested, the evidence supported it, and no change was necessary. That is still a conclusion.

At the end of the process, you should be able to answer:

That is why the stress-test analogy is more useful than the report-card analogy. A report card tells you what happened. A stress test tells you how the system responds when you put it under pressure.

The annual review should challenge the policies, examine the evidence, surface inconsistencies, and leave the firm clear on what needs attention. The objective is not to finish the review. It is to know what the review tells you about the strength of the program. And that is ultimately what an examiner wants to understand too.

You do not have to carry the review and every follow-up alone. NextReg works alongside CCOs to test the program, document the findings, and turn them into action with clear ownership. If you want support that goes beyond recommendations, schedule a consultation with our team. Let’s talk about what your next review needs to uncover and who will do the work to close the gaps.