On September 14, 2026, the Securities and Exchange Commission's (SEC) Division of Examinations issued a risk alert summarizing its examination observations on investment advisers’ annual compliance reviews. The alert identifies recurring deficiencies across six categories and is intended to assist advisers in strengthening their compliance programs.
While the risk alert reflects the views of the SEC exam staff and does not create new legal obligations, it offers important insight into the SEC’s current examination priorities and expectations.
Annual Review Requirements
Rule 206(4)-7 under the Investment Advisers Act of 1940, known as the Compliance Rule, requires each SEC-registered investment adviser to adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act. Advisers must review those policies and procedures at least annually to assess whether they remain adequate and effective. They also must designate a chief compliance officer (CCO) responsible for administering the compliance program.
The SEC’s adopting release for the rule says that an annual review should consider compliance matters from the previous year, changes in the adviser’s or its affiliates’ business activities, and any changes in the Advisers Act or applicable regulations that warrant updates to the adviser’s policies or procedures.
The adopting release also states that advisers should consider interim reviews in response to significant compliance events, business changes, and regulatory developments. In addition, Rule 204-2(a)(17)(ii) requires advisers to maintain accurate and current books and records documenting their annual reviews.
Examination and Enforcement Focus
The alert is consistent with the SEC’s fiscal year 2026 examination priorities, which listed the effectiveness of advisers’ compliance programs, including annual reviews, as a key focus area.
It also follows several recent enforcement actions highlighting the consequences of compliance program failures. In June 2026, the SEC imposed a $1.2 million civil penalty against an investment adviser for failing to properly implement compliance policies and conduct annual reviews. In August 2025, the SEC imposed a $19.5 million civil penalty against another investment adviser for failing to adopt and implement policies reasonably designed to address the conflict-of-interest disclosures.
Six Areas of Examination Concern
The risk alert organizes the observations into six categories, each highlighting specific deficiencies examiners have observed across investment advisers.
Timeliness of annual reviews
Examiners observed advisers with gaps in their annual review cycles, including advisers conducting reviews for 2021 and 2023 but omitting 2022. Some advisers reviewed periods longer than 12 months, including initial reviews conducted 18 months after registration or reviews delayed after a CCO departure.
In some cases, advisers substituted compliance training sessions or annual employee attestations for substantive annual reviews, which SEC exam staff viewed as insufficient. The staff also flagged advisers that had not remediated deficiencies identified in prior examinations and continued to fail to conduct timely reviews.
Completeness of review policies and procedures
The SEC examiners found that many advisers had compliance policies stating that annual reviews would be conducted but lacked corresponding procedures specifying how those reviews should be performed.
For example, some advisers’ policies required documentation, testing, and validation but provided no procedural guidance on the review process, evaluation factors, documentation requirements, or steps to be followed. In other cases, practices required in a compliance manual were left out of the annual review.
Consistency with written procedures
Even when advisers conducted timely annual reviews, the SEC examiners found that some reviews did not follow the adviser’s own written procedures.
Some advisers failed to follow procedures requiring defined review periods, specified work papers, or specific tasks and tests. Others reviewed outdated or superseded policies and procedures rather than the versions currently in effect, rendering the review incomplete.
Alignment of policies with actual practices
The SEC exam staff observed that some annual reviews failed to identify meaningful gaps between written policies and actual business practices.
Those gaps appeared in several areas, including fee and expense billing deviations, proxy voting, custody policies, and marketing policies. Examples included advisers using different fee calculation methods than their policies described, failing to prorate fees, failing to apply breakpoints, or failing to issue refunds. Other advisers had proxy voting policies stating that they would vote proxies but were not actually doing so, custody policies that omitted required steps for surprise examinations, or marketing policies that had not been updated for the SEC’s Marketing Rule.
The examiners also observed regulatory filing procedures that had not been updated to meet Form CRS requirements, policies that delegated services to third parties without adequate oversight provisions, and instances of noncompliance identified during the review period but not addressed in the annual review.
Documentation maintenance
The SEC staff found that some advisers created annual review documentation but did not maintain it as part of their books and records as required under Rule 204-2(a)(17)(ii). Other advisers did not maintain testing records, records of issues identified, or records of recommended corrective actions.
In some cases, advisers’ policies required written annual review reports, checklists, work papers, or templates, but those documents were never completed or retained.
Follow-through on corrective actions
The SEC exam staff also observed advisers that did not implement the changes and improvements recommended in their own annual reviews. Examples included recommendations to improve proxy voting disclosures, document client risk tolerances, and to conduct more thorough best execution analyses.
In some cases, advisers reported that corrective actions had been implemented, but examiners found that the underlying issues persisted.
What Advisers Should Consider
Although the risk alert does not create new legal obligations, it provides a clear signal of the SEC’s examination focus and a useful framework for assessing examination preparedness. Advisers should consider the following steps:
Conduct a self-assessment. Advisers should evaluate their existing annual review programs against each of the risk alert’s six categories of observations. That assessment should identify gaps in timing, procedural completeness, consistency of execution, alignment with actual practices, documentation, and follow-through on corrective actions.
Review and update procedures. If a compliance manual requires an annual review but does not include detailed procedures for conducting it, advisers should develop and adopt specific procedural guidance, including evaluation criteria, documentation standards, and responsible personnel.
Compare policies with practice. Advisers should review whether their written policies reflect their actual business operations. Areas flagged by examiners, including fee billing, proxy voting, custody, marketing, and regulatory filings, merit particular attention.
Strengthen documentation practices. Advisers should treat annual review documentation as a books-and-records obligation and retain all testing records, findings, and corrective action plans in accordance with Rule 204-2(a)(17)(ii).
Close the loop on corrective actions. Advisers should implement a formal tracking mechanism to ensure that corrective actions identified during annual reviews are completed and verified before the next review cycle. The SEC’s focus on recidivist conduct suggests that examiners will closely scrutinize advisers that have previously received deficiency letters on these issues.
Preparing for the Examination
The risk alert is a significant staff communication that investment advisers should take seriously. While it does not impose new regulatory requirements, it provides a detailed framework advisers can use to evaluate their programs. Together with the SEC’s fiscal year 2026 examination priorities and recent enforcement activity, the alert signals that compliance program effectiveness—and particularly the annual review process—will remain a central examination focus.
Advisers that assess their annual review practices against the SEC examiners’ observations, remediate identified weaknesses, and maintain robust documentation will be better positioned to demonstrate a culture of compliance during their next examination. Advisers with recurring or unaddressed deficiencies face heightened regulatory risk, particularly in light of the SEC’s demonstrated willingness to pursue enforcement actions and its focus on recidivist conduct.
Alston & Bird is ready to help you evaluate what the SEC’s risk alert means for your compliance program.
If you have any questions, or would like additional information, please contact one of the attorneys on our Investment Funds team.
You can subscribe to future advisories and other Alston & Bird publications by completing our publications subscription form.