The SEC’s Division of Examinations recently issued a new Risk Alert (the “Alert”) on Staff observations from examinations of SEC registered investment advisers’ compliance with Rule 206(4)-7 of the Investment Advisers Act of 1940 (“Advisers Act”). The focus of the Alert is on how advisers have complied (or not) with the Annual Compliance Review (“Annual Review”) requirements of the Rule.
Each Annual Review for a firm must contain certain elements that were outlined in the adopting release to the Rule. The basic elements to include in the written Annual Review are:
- Compliance matters or breaches during the past 12-month Review Period
- Changes to the business activities of the firm or its affiliates during the Review Period
- New regulations or changes in regulations that affect the compliance program
- Retention of documents that support the Annual Review (exhibits)
The Alert goes into detail on what examiners expect to find in the written Annual Review and how firms often fail to comply with the Rule on a number of issues.
Annual Review Timelines
Many examinations found that the timeline of the Annual Review performed did not meet the 12-month requirement. Newly registered advisers were waiting eighteen months to conduct their first Annual Review when the requirement is to conduct the first Annual Review within 12 months of the firm’s registration date. The original adopting release for Rule 206(4)-7 gave firms an eighteen-month window to complete the first Annual Review under the new Rule, but that was a specific grace period provided for the initial Annual Review under the new Rule only. All further Annual Reviews after the grace period were required to occur within 12 months. In addition, some firms were simply not conducting Annual Reviews in a consistent manner by skipping years or covering more than 12 months in a review cycle.
Other Common Deficiencies
The goal of the Alert was to make the industry aware of the various deficiencies found during examinations to provide guidance on how Annual Reviews are to be completed in a consistent and compliant way. A list of common deficiencies discovered during exams included:
- Not having an actual cohesive written report and simply using system certifications as “evidence of review”
- Recidivist firms not taking corrective actions regarding their Annual Review
- Inadequate or undocumented testing of compliance processes to validate policies and procedures
- Failing to document and review items that were scheduled for review as part of the Annual Review process
- Testing outdated or inaccurate compliance policies as part of the Annual Review
- Firms not making the connection between policies and actual practice of the firm functions, resulting in written policies that did not match actual firm operations
- Breaches identified but not discussed in the report
- Lack of documentation regarding changes to policies and procedures
- Failure to document the Annual Review as described in firm policies
- Failure to take corrective measures when compliance violations or weaknesses are discovered
Testing of Firm Functions
The Staff mentioned and implied the importance of testing multiple times within the Alert. Certain specific compliance areas were also mentioned and called out regarding testing deficiencies found, including:
- Fee and expense billing practices
- Proxy voting policies and practices
- Custody policies and procedures
- Marketing policies and procedures
- Regulatory filings
- Oversight of delegated authority to third parties
At FrontLine Compliance, we have also discovered many of the deficiencies noted above when reviewing firms during SEC mock exams, our ongoing testing work or other compliance support we provide. The testing of firm compliance operations is a crucial component of a successful Annual Review. The testing should take the form of a deep dive forensic analysis of the target areas that includes sampling of materials or other backup documentation. A firm cannot test every part of its compliance program each year since there is simply not the time. Instead, testing should take a risk-based approach and rotate among target areas each year. This is critical to completing an Annual Review that is in compliance – and one that will almost always be requested for review as part of an exam by the SEC.
