Risk Alert: SEC Investment Adviser Annual Compliance Reviews

The Securities and Exchange Commission (SEC) Division of Examinations (Division) has issued a Risk Alert relating the requirement that investment advisers conduct a review of their compliance policies and procedures at least annually to assess their adequacy and implementation effectiveness. The Division highlights five areas of focus based on staff observations from recent examinations, which include:

• Conducting timely annual reviews.
• Adopting complete policies and procedures for conducting annual reviews.
• Aligning annual reviews with the advisers’ policies, procedures, and practices,
• Maintaining documentation made regarding annual reviews.
• Taking corrective actions for issues identified in annual reviews.

In a separate release, the Division Director outlined efforts to improve the examination process along with some observations “that may lead to a smoother examination process,” including how registrants may assist. The Director also announced the SEC would soon release a new EXAMS Brochure, which will provide an overview of what to expect during an examination, as well as guidance on steps to take if any issues arise.

Conducting Timely Annual Reviews

The Division staff observed advisers that did not perform reviews of compliance policies and procedures for adequacy and effectiveness at least annually as required. Examples include:

• Gaps in annual reviews (e.g., omitting certain years).
• Reviews performed for periods greater than 12 months (e.g., due to personnel changes such as a change in Chief Compliance Officer).
• Providing training or obtaining attestations in lieu of annual reviews.
• Failure to take corrective action after receiving previous deficiency letters from Division staff.

Adopting Complete Policies and Procedures for Conducting Annual Reviews

The Division staff observed advisers that had compliance policies requiring annual reviews but did not adopt procedures, or had incomplete procedures, for their personnel to use when assessing whether policies and procedures were adequately and effectively implemented.  Examples include advisers that:

• Failed to document procedures providing direction and processes for testing and validation, factors to consider when evaluating the adequacy and effectiveness of implementation, or the types or level of support documentation needed.
• Identified areas to be assessed in compliance policies and procedures but did not include these topics in their policies and procedures for annual review.

Aligning the Annual Reviews with the Advisers’ Policies, Procedures, and Practices

The Division staff observed advisers that conducted timely annual reviews but did not do so in a manner that was consistent with their written procedures, including:

• Not following their own policies and procedures that required a defined review period or scope, utilization of specific documentation, or performance of specific tasks.
• Assessing the effectiveness of incorrect or outdated documents.

The Division staff also observed advisers that did not recognize during annual reviews that their policies and procedures did not fully address or were not aligned with their practices. Examples include:

• Policies and procedures that do not address pivotal risk areas for the business.
• Changes in business activities not considered when assessing the adequacy and effectiveness of policies and procedures.
• Observed issues in core areas not identified in annual reviews, such as:
  • Fee and expense billing practices that deviate from policies and procedures and/or client disclosures, including fee methodologies, breakpoints, and refunds.
  • Proxy voting policies that were not followed in practice.
  • Custody policies and procedures that omitted steps to ensure identification of accounts.
  • Policies and procedures not updated to reflect new regulatory requirements.

Maintaining Documentation Made Regarding Annual Reviews

The Division staff observed advisers that created documentation when conducting their annual reviews but did not maintain the documentation in their books and records. Examples include Advisers that:

• Included discussions of compliance violations in their written annual review reports but did not maintain documentation about how those issues were addressed.
• Adopted policies and procedures requiring their annual reviews to be memorialized in written reports covering specific topics, but no written annual review reports were prepared.
• Adopted policies and procedures requiring the annual review to be documented in a specific manner (e.g., checklists, workpapers, or templates) but not carrying through with those requirements.

Taking Corrective Actions for Issues Identified in Annual Reviews

The Division staff observed advisers that did not take corrective actions to amend compliance policies, procedures, disclosures, and/or business practices that were recommended following annual reviews. This included instances where advisers indicated that corrective actions had been implemented but the issues persisted. Examples provided include recommended changes to:

• Proxy voting practice disclosures.
• Client risk tolerances documentation.
• Best execution analysis.
• Third-party due diligence.