SEC Exams Staff: Advisers' Compliance Reviews Miss What They Should Catch

The SEC Division of Examinations issued a Risk Alert detailing deficiencies its staff observed in how registered investment advisers conduct their required annual compliance reviews (see prior coverage).

In the Risk Alert, the Division stated that examiners found issues in the following areas: timeliness, the completeness of policies and procedures for conducting reviews, consistency with written procedures, alignment with actual practices, documentation, and corrective actions. On timeliness, examiners found advisers with gaps between annual reviews, reviews spanning more than 12 months, and firms that substituted compliance training or personnel attestations for an actual review. On completeness, some advisers had policies requiring annual reviews but did not adopt procedures telling personnel how to test and validate the firm's compliance policies, what factors to weigh in judging whether those policies were adequate and effectively implemented, or what documentation to create and keep to support the reviews. Separately, some advisers identified practices or operations for annual-review testing in other sections of their manuals but left those topics out of their annual-review procedures, so the reviews never covered them. The staff's example was identity theft policies and procedures that the adviser's own manual required be tested annually.

The Division also observed reviews that did not follow advisers' own written procedures, including assessments of outdated policy documents. Other reviews failed to catch misalignment between written policies and actual practices, such as fee-billing methodologies that deviated from disclosures, proxy-voting policies that did not match actual practice, custody procedures lacking accountant-notification steps, and marketing or relationship summary procedures that were not updated for rule changes. Separately, the staff found advisers that created review documentation but failed to retain it, and advisers that did not implement corrective actions their own reviews had recommended.