For many investment advisers, the annual compliance review culminates in a written report documenting the firm’s policies, procedures and recommended improvements. While that report may provide a useful summary of the year’s compliance activities, it does not necessarily demonstrate that the firm’s compliance program is working as intended.
The Securities and Exchange Commission (SEC) reinforced this distinction in its September 14, 2026, Risk Alert, Examinations Observations Regarding Investment Adviser Annual Compliance Reviews. The Alert highlights deficiencies identified during examinations, including incomplete reviews, inadequate testing, outdated policies and recommendations that firms failed to implement.
The SEC’s fiscal year 2027 examination priorities released in October reinforce this focus. The Division of Examinations identified compliance program effectiveness as a key area of review, including whether advisers have implemented their policies and procedures, addressed conflicts of interest and adapted their compliance programs to changes in their businesses.
The message for investment advisers is clear. Completing an annual compliance report is not the same as conducting an effective annual compliance review. Advisers must look beyond the documentation to evaluate whether their policies address the risks within their business, whether employees follow those policies and whether the firm takes appropriate action when it identifies deficiencies.
Under Rule 206(4)-7 of the Investment Advisers Act of 1940, SEC-registered investment advisers must annually assess the adequacy of their compliance policies and procedures and the effectiveness of their implementation. While the rule does not require a formal written report, Rule 204-2 requires advisers to maintain records documenting the review. Many firms choose to prepare a report, but documentation alone does not demonstrate an effective compliance program. The SEC’s Risk Alert reinforces the importance of conducting meaningful testing, keeping policies current and addressing identified deficiencies.
The SEC’s Risk Alert identified several recurring weaknesses in how advisers fulfill these obligations. Three findings deserve special attention.
1 | Testing does not support the conclusions: A compliance review should do more than confirm that policies exist. It should evaluate whether those policies adequately address the firm’s risks and whether employees consistently implement them.
The SEC observed advisers whose written procedures called for specific testing, validation or documentation, but whose annual reviews did not follow those requirements. In other cases, firms assessed outdated versions of policies rather than the procedures that actually governed their operations. These gaps raise an important question: How can an adviser conclude that its compliance program is effective without examining whether its controls work in practice?
For example, a firm may have written policies governing fee calculations, expense allocations, marketing activities or third-party oversight. For private fund advisers, the SEC’s FY2027 priorities also emphasize controls addressing fund-level and investment-level risks, including allocation practices, use of affiliated service providers and the accuracy of fees and expenses. However, advisers must also test whether employees follow those policies and maintain sufficient documentation to support their conclusions.
2 | Written policies do not reflect business practices: Investment advisers evolve as they introduce new strategies, expand services, adopt technology and engage service providers. However, their compliance policies do not always keep pace. The SEC identified advisers whose annual reviews failed to recognize these gaps, including inconsistencies in fee billing practices, outdated marketing policies, gaps in custody procedures and insufficient oversight of delegated responsibilities.
An effective review should consider what changed during the year and whether those changes introduced new compliance risks. The SEC’s FY2027 examination priorities specifically highlight advisers that have changed their business models, introduced new asset classes or services, or grown through mergers and acquisitions. Examiners will assess whether compliance programs have kept pace with those developments. For private fund advisers, this may include reviewing how the firm handles fund expenses, manages conflicts of interest, oversees service providers and implements applicable disclosure requirements.
3 | Firms identify deficiencies but fail to correct them: Perhaps the most consequential finding in the Risk Alert involved advisers that identified compliance weaknesses but failed to implement recommended improvements. In some cases, advisers reported that they had implemented changes even though examiners found the same deficiencies persisted.
When an annual review identifies a weakness, the firm has documented its awareness of the issue. If the same problem continues without appropriate remediation, the review may demonstrate that the firm recognized a risk but failed to address it. For this reason, advisers should treat corrective action as an essential component of the annual review process rather than a separate administrative task.
The SEC’s observations offer investment advisers an opportunity to reassess how they approach their annual reviews. Several practices can help strengthen that process.
Align testing with the firm’s actual risks. Review policy changes alongside new investment strategies, service provider arrangements and operational changes to ensure that written procedures reflect how the business operates. Advisers should also confirm that annual reviews assess the policies and procedures applicable to the period under review.
Keep policies and procedures current. Advisers should evaluate whether changes in business activities, regulatory requirements or internal operations require updates to their compliance programs. They should also confirm that annual reviews assess the policies and procedures applicable to the period under review.
Maintain documentation that supports the review. Firms should retain appropriate evidence of the testing performed, findings identified and corrective actions recommended. A summary report alone may not provide sufficient support for the conclusions reached.
Establish accountability for remediation. When a review identifies deficiencies, advisers should assign responsibility for corrective action, establish reasonable timelines and monitor progress. Firms should also verify that completed actions effectively address the identified issues.
Consider compliance throughout the year. Although the rule requires reviews at least annually, significant compliance events, operational changes or regulatory developments may warrant interim assessments. Advisers should also consider the SEC’s annual examination priorities to identify areas that may require additional attention, particularly those relevant to their business and associated risks. Ongoing monitoring can help firms identify and address issues before the next annual review.
These practices can help advisers create a more meaningful connection between their written compliance programs and their day-to-day operations.
The SEC’s September 2026 Risk Alert serves as an important reminder that an effective compliance program requires more than an annual review. Advisers need to demonstrate that their policies reflect how their business operates, that appropriate testing takes place and that identified weaknesses lead to corrective action.
At Petra Funds Group, we work with private fund managers to help them navigate these responsibilities. Our compliance team helps advisers assess their policies and procedures, evaluate compliance risks, conduct reviews and testing, and identify areas where improvements may be needed. We also help firms address findings and strengthen their compliance processes as their businesses evolve. To learn more about Petra’s Regulatory Compliance services reach out to Jesse Brown.
The SEC has proposed rescinding its Pay-to-Play Rule, a change that could affect compliance requirements for private fund advisers. Here’s what advisers need to know while the proposal is under consideration.
As private fund advisers increasingly use AI agents for investor reporting, regulatory filings and portfolio analysis, AI governance is becoming an important compliance consideration. This article examines what SEC requirements mean for AI-enabled workflows and the controls firms need to put in place around data access, recordkeeping, supervision and investor disclosures.
The SEC’s recent Compliance Outreach webinar made clear that amended Regulation S-P is now an exam priority, with advisers expected to demonstrate that information security and incident response policies are not only documented, but actively implemented, monitored, and aligned with the rule’s enhanced requirements.