Key Takeaways

  • SEC Rule 206(4)-7 requires every registered investment adviser to review, at least annually, the adequacy of its written compliance policies and the effectiveness of their implementation
  • A defensible annual review needs to cover five areas: business and operational changes, Marketing Rule compliance, Reg S-P and vendor safeguards, employee attestations, and books and records
  • The 2026 review cycle carries extra weight because amended Reg S-P compliance dates have already passed, meaning firms must show their safeguarding framework is actually working, not just written down
  • A missed or superficial annual review is a recurring SEC examination finding and can itself count as a violation
  • Keep reading for an end-of-year checklist that turns a scramble into a simple summary of records already on hand

Every fall, compliance officers at registered investment advisory firms start eyeing the calendar with a familiar dread. The annual review is coming, and with it, the hunt for code-of-ethics attestations, trade blotters, marketing files, and proof that last year’s ADV updates actually happened. The review itself does not have to feel like a fire drill. It only feels that way when the underlying work gets scattered across the year instead of captured as it happens.

“An effective annual compliance review should help advisers understand whether their policies are working in practice, not simply confirm that required tasks were completed,” says Blake Bjordahl, founder and president of RIA Compliance Technology. “When testing records and corrective actions are documented throughout the year, compliance officers have a clearer basis for evaluating their programs and addressing potential weaknesses.”

What Rule 206(4)-7 Requires Annually

SEC Rule 206(4)-7 requires every registered investment adviser to review, at least once a year, how adequate its written compliance policies and procedures are and whether those policies are actually working in practice. The rule does not pin down a specific calendar date, which is exactly why most firms anchor the review to their calendar or fiscal year-end. Examiners expect to see a completed, dated review covering the prior twelve months, not a vague assurance that “things were checked.”

The key distinction examiners look for is effectiveness, not existence. A firm can have a thick binder of policies sitting untouched on a shelf, but if nobody tested whether those policies matched day-to-day practice, the review falls short.

The review should also weigh anything unusual that came up during the year: compliance matters that surfaced, shifts in business activities, and any changes to the Advisers Act or related regulations. Treating the annual review as a forward-looking checkup, rather than a backward-looking box to check, is what separates firms that sail through examinations from those that draw follow-up questions.

Five Areas Your Review Must Cover

A thorough annual review touches five distinct areas. Skipping or skimming any one of them is a common reason reviews get flagged during SEC examinations.

Business and Operational Changes

Firms grow and shift throughout the year, and the review needs to catch every change that matters. This includes new custodians, new share classes or fee structures, growth that pushes assets under management across a registration threshold, new advisory services, branch openings, and changes in ownership or control persons. For each of these, the review should confirm whether Form ADV and internal policies were updated to reflect the change. A new custodian relationship that never made it into the ADV, for example, is exactly the kind of gap examiners notice quickly.

Marketing Rule Compliance

Advertisements, testimonials, endorsements, and performance presentations all need to be reviewed against the current Marketing Rule, 17 CFR § 275.206(4)-1. The rule defines what counts as an advertisement and prohibits misleading claims, requiring a fair and balanced presentation of risks alongside any benefits. Firms need documentation connecting marketing claims to actual performance outcomes, along with evidence of a pre-dissemination review process showing someone actually checked materials before they went out.

Reg S-P and Vendor Safeguards

This area carries extra weight in the 2026 review cycle. The amended Regulation S-P requires covered institutions, including every SEC-registered RIA, to maintain written policies and procedures for an incident response program capable of detecting, responding to, and recovering from unauthorized access to customer information. For most SEC-registered advisers, the compliance deadline for amended Reg S-P was June 3, 2026, which means this is the first annual review where firms need to show the full safeguarding and breach-notification framework is actually operating. The rule also requires notifying affected individuals no later than 30 days after a firm becomes aware of unauthorized access to sensitive customer data. Reviewing vendor contracts and safeguarding documentation against this standard, rather than assuming last year’s paperwork still applies, is essential.

Employee Attestations

Annual code-of-ethics acknowledgments, outside business activity disclosures, and political contribution certifications are generally collected from every access person once a year, and they are frequently among the first records examiners request. The review should also confirm that personal trading was reviewed and reconciled consistently throughout the year, not reconstructed after the fact from scattered brokerage statements.

Books and Records

SEC Rule 204-2 requires RIAs to maintain specific records documenting advisory activity, client communications, and supervisory oversight, each preserved for defined retention periods. Recordkeeping deficiencies show up constantly in SEC examinations, often not because records are missing entirely, but because they exist in a form that is not promptly producible, not indexed for quick retrieval, or not retained for the full required period. The annual review needs to confirm records are retrievable on demand, not merely saved somewhere.

Why the Review Turns Into a Scramble

The annual review rarely gets stressful because the requirements are unclear. It gets stressful because, by the time someone sits down to write it, they are reconstructing a full year of activity from scratch.

The SEC’s Division of Examinations has pointed to five compliance areas that generate recurring issues: Rule 206(4)-7 itself, required regulatory filings, the Custody Rule under Rule 206(4)-2, the Code of Ethics Rule under Rule 204A-1, and the Books and Records Rule under Rule 204-2. Every one of these problems traces back to the same root cause: documentation that was never captured consistently as the year unfolded.

Tracking Compliance Continuously All Year

Firms that complete their annual review without last-minute panic are not doing less work than everyone else. They are doing the same work, just spread across twelve months instead of crammed into one.

Compliance software supports this shift by monitoring advisory activity continuously, documenting decisions as they happen, and giving firms a clear record they can explain confidently if questions come up later. A single compliance calendar that tracks every deadline and task, automatic archiving of communications as they occur, and an electronic workflow for reviewing personal trading all turn what used to be a research project into a simple data pull. Attestation processes benefit the same way: automated systems can produce annual certifications and give compliance officers a dashboard view of who still needs to sign off, instead of chasing signatures by email in December.

End-of-Year Review Checklist

Whether or not a firm has adopted compliance technology yet, working through this checklist before year-end requirements pile up is worth the time.

Confirm Business and ADV Changes

Check that every business, ownership, and personnel change from the year is accurately reflected in Form ADV and in internal policies and procedures. This includes anything from new custodial relationships to shifts in control persons.

Review Marketing and Advertising Materials

Pull this year’s advertisements, testimonials, and performance materials and review them against the current Marketing Rule, confirming that each piece has documented evidence of pre-dissemination review.

Verify Reg S-P Safeguards

Confirm vendor safeguarding documentation is current, test that breach-notification procedures are ready to execute, and verify incident-response readiness reflects the amended Reg S-P requirements now in effect.

Collect Attestations and Confirm Trading Reviews

Gather annual code-of-ethics acknowledgments, outside business activity disclosures, and political contribution certifications from every access person, and confirm personal trading was reviewed and reconciled across the full year.

Retain Communications and Deliver Privacy Notices

Confirm required electronic communications were retained, remain searchable, and were supervised on schedule throughout the year. Deliver the annual privacy notice, and finally, document the review itself: describe the firm’s business, note who conducted the review, and record what was examined and what, if anything, needs to change.

What Happens When Reviews Fall Short

A missed or superficial annual review is a recurring finding in SEC examinations, and it can constitute a compliance violation on its own, separate from any underlying substantive problem the review might have uncovered. The rule requires the review to actually happen and to be documented; skipping it or treating it as a formality carries its own regulatory risk regardless of whether anything else went wrong during the year.

The chief compliance officer carries direct responsibility here. Failing to appoint a CCO is itself a direct SEC violation, and the CCO is the one accountable for making sure the annual review is performed, documented, and acted upon. A review that identifies a gap but never leads to a corrective action carries nearly as much risk as skipping the review altogether, since examiners often ask not just what was reviewed, but what changed as a result.

A Documented Review Is a Defensible One

A written report at the end of the annual review should describe the firm’s business, identify who conducted the review, and spell out exactly what was examined. Examiners often request written records showing identified risks, the strategies used to manage them, the tests performed, the results of those tests, and any corrective actions taken afterward. A review that exists only as a mental checklist, without a corresponding paper trail, offers little protection if a regulator comes asking questions.

Building that documentation gradually, rather than assembling it in a last-minute push, turns the annual review from an annual headache into routine housekeeping. Firms evaluating their current approach can explore RIA Compliance Technology to learn how structured compliance workflows support ongoing testing and documentation.

RIA Compliance Technology

10031 E Dynamite Blvd Suite 240
Scottsdale
AZ
85262
United States

About The Author
NewsNetwork