SEC Risk Alert on Annual Compliance Reviews

On September 14, 2026, the Division of Examinations issued a Risk Alert identifying recurring deficiencies observed during examinations of advisers' annual compliance reviews required under Rule 206(4)-7 of the Investment Advisers Act of 1940. The staff outlined six areas where firms most often fall short, spanning review timeliness through follow-through on corrective action.

What they found:

• Timeliness: reviews conducted more than 12 months apart, or substituted with compliance training or employee attestations rather than a full annual review.
• Completeness: written policies required a review, but firms lacked procedures explaining how to test, evaluate, and document it.
• Consistency: reviews that didn't follow the firm's own written procedures, or that assessed outdated, superseded versions of those policies.
• Policy-practice alignment: gaps between written policies and actual practices, including fee and expense billing, proxy voting, custody procedures, marketing rule compliance, Form CRS, and oversight of delegated third-party services.
• Documentation: review findings, testing records, and corrective action plans not retained in the firm's books and records as required under Rule 204-2(a)(17)(ii).
• Corrective actions: issues identified but never remediated, including review reports that stated corrective action had been taken when the underlying issue persisted.

ICS supports firms in reviewing and strengthening their annual compliance review process against current SEC examination expectations.

ICS advises financial institutions navigating regulatory changes of this type. If your firm needs to assess the impact of this development on your compliance program, contact us to discuss.