On September 14, 2026, the SEC’s Division of Examinations published a Risk Alert on a rule that’s been on the books for over two decades: the requirement that every registered investment adviser conduct a genuine, documented annual review of its compliance policies and procedures under Rule 206(4)-7.
It’s not a new rule. It’s not even a new area of focus. But the staff’s latest observations make one thing clear: after twenty years, a surprising number of firms are still getting the basics wrong — and examiners are watching closely.
For compliance teams, that’s a warning. For firms that treat the annual review as a genuine business process rather than a check-the-box exercise, it’s an opportunity to stand out. Here’s what the SEC found, and what it says about the difference between firms that merely have a compliance program and firms that can prove it works.
Five Places Annual Reviews Break Down
- “Annual” turned out to be optional.Examiners found firms with gaps in their review history — a review for 2021, one for 2023, and nothing in between. Others stretched their review cycle past 12 months, sometimes citing a CCO departure or a business change as the reason. Some firms substituted employee training or attestations for an actual review of whether their policies were working. None of that satisfies the rule, and repeat offenders — firms already flagged in a prior deficiency letter — drew particular scrutiny.
- The instructions for doing the review didn’t exist.Plenty of firms had a policy thatsaid an annual review was required. Far fewer had a documented procedure for how to actually perform one: what to test, what “adequate” looks like, what documentation to produce. Without that roadmap, the review becomes whatever the person doing it happens to remember to check.
- The review didn’t follow the firm’s own rulebook.Some firms did the review on time, then didn’t follow their own documented process — skipping required work papers, missing a defined scope, or, in one telling example, testing an outdated version of a policy that had already been superseded.
- The review missed what was actually happening in the business.This is the one with the most teeth. Examiners compared firms’ annual reviews against what was really going on in the business and found reviews that missed fee-calculation errors, proxy voting practices that didn’t match client disclosures, custody procedures with gaps, marketing materials that hadn’t caught up to the Marketing Rule, and Form CRS obligations that fell through the cracks. In several cases, known compliance incidents from earlier in the year weren’t even mentioned in the annual review meant to catch exactly that kind of thing.
- The paper trail didn’t exist — or didn’t match the policy.Some firms did real work — testing, corrective action plans — and then didn’t keep the records. Others had a policy requiring a written report and simply never produced one. And some firms’ own reviews flagged real problems, recommended fixes, and then nothing changed. The same issues resurfaced the following year, sometimes with a report that claimed they’d already been resolved.
The Common Thread
Read across all five findings, and the pattern isn’t about bad intentions — it’s about infrastructure. Firms with strong compliance cultures still get tripped up when the process of proving that culture is manual, inconsistent, or scattered across email threads, spreadsheets, and someone’s memory of what happened last March.
That’s exactly the gap InvestorCOM was built to close.
Turning the Annual Review From a Liability Into a Story You Want Regulators to Read
At InvestorCOM, we’ve long believed that regulatory obligations shouldn’t be treated as a burden to survive — they’re a chance to demonstrate the rigor and client-first culture that sets your firm apart. This Risk Alert is a direct illustration of why.
ComplianceExpress was designed around the exact discipline the SEC is asking for: a structured, repeatable, time-stamped record of what was reviewed, when, by whom, against which version of your policies, and what happened next. Instead of reconstructing a review cycle from scattered documents after an exam letter arrives, firms using ComplianceExpress can produce the full history — testing performed, issues identified, corrective actions tracked to completion — in the format examiners are explicitly asking to see.
Firms already familiar with the discipline of an annual retrospective review under PTE 2020-02’s rollover requirements — a documented, senior-executive-certified process — will recognize the shape of what the SEC is now asking of the entire compliance program. The same rigor that RolloverAnalyzer brings to defensible, audit-ready rollover recommendations is the model for what an effective firm-wide annual review should look like: consistent, documented, and easy to produce on request.
And for firms whose annual review needs to assess whether their products, fees, and practices actually hold up against the universe of alternatives — one of the specific gaps examiners called out — PeerCompare gives compliance teams a defensible, evidence-based way to test exactly that, with results that are automatically documented and ready for exam day.
The Real Takeaway
The SEC isn’t asking firms to do something new. It’s asking them to prove they’re already doing what they say they do — consistently, on time, and with a paper trail that holds up. That’s a compliance mindset. It’s also, increasingly, a growth mindset: firms that can produce a clean, well-documented annual review on demand build the kind of trust — with regulators, with clients, with prospects doing due diligence — that turns compliance into a competitive advantage.
Proudly simple isn’t just our philosophy. It’s what a well-run annual review should look like, too.
Curious how ComplianceExpress can help your team close these five gaps before your next exam? Connect with us at investorcom.com/explore.