An RIA annual compliance review should answer three practical questions: Do the firm’s policies address its current risks? Are employees following those policies? What needs to change? A useful review connects written procedures to actual client accounts, business decisions, and daily workflows.
For chief compliance officers and firm leaders, the goal is a review that produces clear findings, supporting evidence, and an actionable improvement plan. This guide explains how to organize that work and turn the results into stronger ongoing RIA compliance.
What Does the Annual Compliance Review Require?
Under SEC Rule 206(4)-7, advisers registered or required to register with the SEC must review their compliance policies and procedures at least annually for adequacy and effectiveness of implementation. State-registered RIAs should evaluate the requirements of their applicable jurisdictions rather than assume the SEC rule applies identically.
The review should consider compliance issues, changes in the firm’s or affiliates’ business, and relevant regulatory developments. Significant changes may also warrant an interim review. The annual review is separate from the annual Form ADV update; completing a filing does not evaluate whether the compliance program works.
The SEC’s September 2026 risk alert identifies concerns involving review timing, procedures, alignment with business practices, documentation, and corrective action. The alert describes staff observations; it does not create new legal obligations.
Start With a Review Plan That Fits the Firm
Before selecting documents, define the review period, completion schedule, responsible reviewers, and business areas to assess. Read the firm’s own annual review procedures and identify any required tests, forms, or reporting steps.
Build the plan around how the firm operates today. A new investment strategy, acquisition, billing platform, referral arrangement, or communication channel can introduce risks that last year’s checklist did not address. Interview the employees who perform the work to identify changes that have not reached the compliance manual.
For each area, identify the control being tested, the evidence needed, and the reason for the sample selection. A targeted sample may include higher-risk accounts, recent changes, and prior exceptions alongside ordinary transactions. Explain the sample’s limitations, and expand testing when findings suggest a broader problem.
What Should an RIA Test?
The following are practical testing examples to adapt to the firm’s services and applicable obligations. They are not a universal list of mandatory tests.
1. Advisory Fees and Billing
Recalculate selected invoices using the signed advisory agreement, applicable fee schedule, account values, and billing methodology. Include accounts with negotiated rates, fee breakpoints, deposits or withdrawals, and terminations. Check whether refunds or prorations required by the agreement were handled correctly.
For example, if a household qualifies for a reduced fee after reaching an agreed asset threshold, verify that the billing system applied the reduction. Keep the recalculation and investigate whether the same configuration affects other households.
2. Disclosures and Conflicts of Interest
Compare Form ADV, client agreements, and Form CRS where applicable with actual services, compensation, affiliations, and referral practices. Ask employees to explain how conflicts are identified, escalated, and addressed. A disclosure review is more useful when paired with evidence of the underlying business arrangement.
3. Marketing and Client Communications
Select website pages, social posts, presentations, and other advertisements for review. Assess applicable marketing rule requirements, approval procedures, support for claims, and the retention of final materials. If the firm uses testimonials, endorsements, ratings, or performance presentations, include those activities in the testing scope.
Also assess whether employees use approved communication channels and whether messages are captured as required. Test retrieval of selected records rather than relying solely on confirmation that an archiving service is active.
4. Portfolio Management and Trading
Compare selected portfolios with documented client objectives, restrictions, and the firm’s stated investment approach. Review trade allocations, errors, and best execution processes where relevant. Trace an exception from discovery through resolution to determine whether escalation and supervision worked.
5. Code of Ethics and Employee Reporting
Review applicable personal trading reports, preclearance requests, certifications, gifts, and outside business activity disclosures. Check timeliness and evidence of supervisory review. Follow up on missing reports and unresolved exceptions; collecting a form alone does not establish that its contents were evaluated.
6. Custody and Client Asset Safeguards
Assess account authorities and arrangements that may raise custody issues, including fee deduction, money movement, and related-person relationships. Evaluate applicable safeguards and exceptions based on the firm’s facts. Confirm that procedures and account inventories reflect current arrangements.
7. Information Security, Vendors, and Business Continuity
Test selected user permissions, employee offboarding, incident escalation, and recovery procedures. Review how the firm oversees providers that handle client information or perform critical tasks. A recovery exercise can reveal whether staff can access essential records and communicate with clients during an interruption.
What Should the Firm Document?
A well-organized review file lets another reviewer understand what was assessed, how conclusions were reached, and what remains unresolved. As a practical approach, assemble:
- The review period, scope, completion dates, and responsible individuals.
- Business and regulatory changes considered, plus the policy versions evaluated.
- Tests performed, samples selected, and supporting workpapers.
- Findings, their significance, and any limitations on the conclusions.
- Corrective actions, accountable owners, target dates, and closure evidence.
The 2023 amendment expressly requiring written annual review documentation was vacated in 2024. That did not eliminate the annual review requirement. Advisers must retain records documenting annual reviews under Rule 204-2, and should follow their own documentation procedures. A written report and supporting workpapers remain a useful way to demonstrate the work performed.
Turn Findings Into Improvements
Assign each finding an owner and a realistic deadline. Prioritize issues involving potential client harm, ongoing errors, or significant control failures. Determine whether the problem comes from an outdated policy, unclear responsibility, insufficient training, a system setting, or a missing supervisory step.
Suppose testing finds a billing error. The action plan should address affected accounts, assess the broader population, determine any necessary client correction, and fix the cause. Afterward, recalculate a fresh sample to confirm the updated process works.
Use the same approach for other findings: identify the issue, correct its effects, change the process, and verify the result. Record open items accurately and escalate overdue actions. An implementation date is more meaningful when supported by evidence that the change took effect.
Build the Next Review Into Ongoing Compliance
Maintain a calendar for recurring testing, keep an exception log, and require business teams to inform the CCO about meaningful operational changes. Use the annual review’s findings to adjust the next year’s monitoring priorities. Repeated exceptions may indicate that a control needs redesign rather than another reminder.
Outside compliance support can help a firm develop its testing plan, evaluate evidence, and manage follow-up. The firm should remain engaged in supplying accurate information, evaluating recommendations, and implementing changes.
RIA Annual Review Support From DFP Partners
DFP Partners provides investment adviser annual review services, RIA compliance consulting, and outsourced CCO services. Whether your firm needs support for its existing CCO or a broader compliance engagement, a tailored review can help connect your written program with the way your business operates.
Contact DFP Partners to discuss your annual compliance review and ongoing RIA compliance needs.