The SEC Just Published the Exam Script for Your Annual Compliance Review

The SEC Published the Checklist Examiners Will Use on Your Annual Review

On September 14, 2026, the SEC's Division of Examinations issued a Risk Alert titled Examinations Observations Regarding Investment Adviser Annual Compliance Review, setting out what examiners found when they tested how SEC-registered advisers perform the annual compliance review required by Rule 206(4)-7. If you run a registered investment adviser, this document is the closest thing you will get to the exam script for your next review.

But here is the part the summary coverage is missing. The most commercially dangerous deficiency the staff described is not skipping the review. It is the adviser that adopted a policy requiring a written annual review report and then never prepared one, or prepared testing records and corrective action recommendations and then failed to keep them in its books and records as required by Advisers Act Rule 204-2(a)(17)(ii).

That is a self-inflicted deficiency. The firm wrote the standard, the firm missed the standard, and the examiner simply read the manual back to the firm. Here is what happened, why the vacated written-review rule does not save you, and what your leadership team should decide this quarter.

Rule 206(4)-7 Is 22 Years Old, and the Written-Review Amendment Is Still Vacated

The Compliance Rule is not new law. The SEC adopted Rule 206(4)-7 on December 17, 2003 in Release No. IA-2204. It became effective February 5, 2004, with a compliance date of October 5, 2004. It requires SEC-registered advisers to adopt written compliance policies and procedures, review them at least annually for adequacy and effectiveness of implementation, and designate a Chief Compliance Officer.

What changed, and then unchanged, is the documentation piece. On August 23, 2023, the Commission adopted Release No. IA-6383, published at 88 FR 63206, which amended Rule 206(4)-7 to require every SEC-registered adviser to document the annual review in writing, effective November 13, 2023.

That amendment did not survive. On June 5, 2024, a unanimous three-judge panel of the Fifth Circuit vacated the Private Fund Adviser Rules in their entirety in National Association of Private Fund Managers v. SEC, No. 23-60471, holding that the Commission exceeded its statutory authority. The vacatur swept in Rule 206(4)-7(b). The freestanding federal mandate to write up your annual review is therefore not in effect. The underlying obligation to conduct the review every year is untouched.

Many firms read the vacatur as permission to stop documenting. The September 2026 Risk Alert shows why that reading is expensive.

Five Deficiency Categories, Read as a Request List

The Division staff grouped its observations into five categories. Read them as the five things an examiner will ask your Chief Compliance Officer to produce.

• Timeliness. Whether the review actually occurred at least annually, rather than eighteen or twenty-four months apart.
• Completeness of the procedures for conducting the review. Whether your manual actually describes how the review gets done, by whom, and covering what.
• Alignment. Whether the review that was performed matches the policies, procedures, and practices the firm says it follows.
• Documentation. Whether records created in connection with the review were maintained as books and records under Rule 204-2(a)(17)(ii).
• Resolution of corrective actions. Whether issues identified in the review were actually fixed, or logged and forgotten.

Notice what four of the five have in common. They are not judgments about whether your compliance program is good. They are tests of whether the firm did what the firm said it would do, and whether it can prove it. That is an evidentiary standard, not a substantive one, and it is the standard that produces deficiency letters fastest.

The Compliance Building summary of the alert makes the same observation from the practitioner side, noting that the staff's focus lands on process discipline rather than the substantive quality of any individual policy, in its rundown of the new Risk Alert.

The Distinction That Matters: Vacated Mandate Versus Live Books-and-Records Duty

Two rules are doing different work here, and conflating them is the mistake that shows up in exam findings.

The vacated rule told you to create a document

Rule 206(4)-7(b) would have compelled a written annual review for every registered adviser. After June 5, 2024, it does not. No adviser is federally required to produce an annual review memorandum as such.

The live rule tells you to keep what you create

Rule 204-2(a)(17)(ii) requires advisers to maintain records documenting the annual review of compliance policies and procedures. The Risk Alert cites it directly. The staff observed advisers that generated testing records and corrective action recommendations during the review and then failed to retain them in the firm's books and records.

There is a third layer, and it is the one that catches sophisticated firms. A compliance manual is enforceable against the adviser that wrote it. If your policies say the CCO will deliver a written annual review report to management, and no report exists, the examiner does not need Rule 206(4)-7(b). The firm failed to follow its own procedures, which is itself a Compliance Rule problem.

The practical rule is simple. Either write the report your manual promises, or amend the manual so it describes what you actually do. Firms that leave aspirational language in a manual they no longer follow are carrying an unpriced exam liability.

What Your Leadership Team Should Decide This Quarter

The annual review is a management obligation, not a paperwork chore that lives entirely with the CCO. Five decisions belong at the executive level before your next examination.

1. Fix the date and the owner. Put the annual review on the calendar with a named owner and a hard completion date, and confirm the interval between the last completed review and the next one is no more than twelve months.
2. Reconcile the manual against reality. Have someone read the compliance manual's description of the annual review process line by line against what the firm actually performed last cycle. Every gap is either a process fix or a manual amendment.
3. Decide the documentation posture deliberately. The written-review mandate is vacated, but the retention duty is not. Most advisers are better served by producing a dated review report and retaining the underlying testing evidence, because the alternative is defending an unwritten process from memory.
4. Close the loop on corrective actions. Maintain a remediation log with the issue, the owner, the target date, and the closure date. Open items with no closure date are the easiest finding an examiner will write all week.
5. Brief the board or management committee. Whoever oversees the firm should receive the review conclusions and the remediation status in writing, on a recurring cadence.

Firms that want a second set of eyes before a document request arrives generally engage SEC exam counsel to run the review as a mock examination, because the finding you identify yourself is a remediation item and the one the staff identifies is a deficiency letter.