Key Examination Findings
The SEC identified several recurring deficiencies:
1. The 12-Month Clock Matters
Examiners cited advisers that:
- Failed to perform annual reviews every year
- Allowed review periods to exceed 12 months
- The 18-month review period many advisers may be familiar with was a one-time exception allowed only during the period following the rule’s original release in 2004 and is therefore no longer applicable
- Business, operational and personnel changes (e.g., Chief Compliance Officer (CCO) departures) are not permissible reasons to extend the 12 month review period
- Relied on compliance training or employee attestations as substitutes for the required annual review
- Repeated previously identified deficiencies without remediation
The SEC reiterated that annual reviews must be conducted no less frequently than every 12 months.
2. Inadequate Review Methodology
Many firms had policies requiring annual reviews but lacked documented procedures explaining:
- What testing should be performed
- How effectiveness should be evaluated
- What evidence should be retained
- How conclusions should be supported
The observations underscore the importance of a defined, documented review methodology that addresses testing, validation, evaluation and recordkeeping.
3. Failure to Follow Written Procedures
Some advisers completed reviews but did not follow their own documented process, including:
- Omitting required testing areas
- Using outdated compliance manuals
- Failing to complete required workpapers or review templates
- Deviating from prescribed review scope
The message is clear firms must do what their policies say they will do.
4. Policies Did Not Reflect Actual Business Practices
A key theme of the alert was the gap between written policies and actual operations. Examiners identified deficiencies involving:
- Fee billing and expense allocations
- Proxy voting practices
- Custody controls
- Marketing Rule compliance
- Form CRS requirements
- Oversight of outsourced or delegated functions
- Compliance incidents identified during the review period
In many cases, annual reviews failed to identify business changes, operational realities or critical risk areas that rendered policies inaccurate or incomplete.
5. Insufficient Documentation
The SEC found firms that performed testing and identified issues but failed to retain supporting documentation. Common deficiencies included:
- Missing test workpapers
- Incomplete review files
- Failure to retain evidence supporting conclusions
- Policies requiring written review reports where no report was prepared
Examiners continue to emphasize that documentation is critical to demonstrating compliance with Rule 206(4)-7 and Rule 204-2 recordkeeping requirements.
6. Remediation Was Identified but Not Implemented
The SEC also cited firms that documented compliance weaknesses and proposed corrective actions but never completed them. In some instances, annual review reports stated that remediation had occurred even though the underlying issue persisted.
