For a lot of firms the annual review happens in one afternoon in December. Someone opens last year’s compliance manual, confirms nothing obviously changed, writes a short memo saying the program remains adequate, dates it, and files it. The box is checked. The problem is that the box was never the requirement.
Rule 206(4)-7 does not ask whether your policies still exist. It asks whether they are adequate and whether they actually worked. Those are different questions, and the second one cannot be answered by rereading the document that describes the policy. It can only be answered by testing what the firm did against what the policy said it would do. The firms that get cited are usually the ones who confirmed the manual was still on the shelf and called that a review.
The short answer: Rule 206(4)-7, the Compliance Rule, requires every SEC-registered adviser to do three things: adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act, review those policies and procedures at least annually for both their adequacy and the effectiveness of their implementation, and designate a chief compliance officer to administer them. The annual review is where most of the work lives, and it is a test of whether the program is working, not a reread of whether it exists.
What is Rule 206(4)-7, the Compliance Rule?
The Compliance Rule was adopted by the SEC in December 2003 and became a compliance obligation in October 2004. Before it, advisers were not required to maintain written compliance policies, review them, or name a compliance officer. The rule created all three obligations at once:
- Adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and its rules by the firm and its supervised persons. The word “implement” matters as much as “adopt.” A policy the firm does not follow is not implemented.
- Review at least annually for the adequacy of those policies and procedures and the effectiveness of their implementation. This is the annual compliance review, and it carries two tests, not one.
- Designate a chief compliance officer, who must be a supervised person, to administer the program. The CCO is the person the SEC will hold responsible for the review actually happening and being real.
The rule is deliberately built around the individual firm. The SEC’s position is that a compliance program should be designed around the specific conflicts and risks of your business, which is also why a generic, off-the-shelf manual with your name dropped into it tends to fail. If the policies do not describe what your firm actually does, the annual review has nothing real to test.
What the annual compliance review must actually cover
The rule and its adopting release set out what the review has to weigh. At a minimum, the annual review should consider three things: any compliance matters that arose during the previous year, any changes in the business activities of the firm or its affiliates, and any changes in the Advisers Act or applicable regulations that might call for revised policies. Layered on top of that is the effectiveness test, which asks not “do we have a policy for this” but “did the policy work in practice over the last year.”
That second layer is the one firms skip, and it is worth being concrete about the difference. Adequacy asks whether the policy, on paper, is designed well enough to prevent the violation it targets. Effectiveness asks whether, in the real transactions and decisions of the past year, the firm actually did what the policy required. A firm can have a perfectly adequate policy that was never followed, and a review that only checks adequacy will pass it every time. Testing effectiveness is what turns a reread into a review, and it is the same discipline behind a serious internal compliance audit playbook: you sample what happened and compare it to what should have happened.
Adequacy versus effectiveness: where policies drift from practice
The most useful way to understand the effectiveness test is to look at where policies and practice quietly separate, because that gap is exactly what the review is meant to catch and what examiners look for when it does not.
In recent examinations the SEC has flagged reviews that failed to notice their own firm had drifted from its written program. Fee and expense billing is a recurring example: the policy and the Form ADV describe one fee methodology, and the actual billing used another, failed to prorate, skipped breakpoints that should have lowered fees, or missed refunds on terminated accounts. Marketing is another: firms whose marketing policies were never updated after the Marketing Rule took effect, so the review measured performance against a policy that no longer matched the rules. The same pattern shows up with proxy voting policies that promised voting the firm did not actually do, custody procedures that left custody accounts off the list given to the surprise-examination accountant, and filing procedures that never accounted for the firm’s obligation to deliver Form CRS to retail clients.
None of those are exotic. They are ordinary drift, and they are invisible to a review that only reads the manual. They become visible the moment you test a sample of real activity against the policy, which is why effectiveness testing, not policy wording, is the heart of a defensible RIA annual compliance review and why it deserves more than a December afternoon.
Does the annual compliance review have to be in writing?
This is where a lot of firms are working from outdated information, so it is worth stating carefully.
As the rule stands today, 206(4)-7 does not legally require the annual review itself to be a written report. In August 2023 the SEC adopted an amendment that would have required exactly that, as part of its Private Fund Adviser Rules. In June 2024 the U.S. Court of Appeals for the Fifth Circuit vacated that entire rule package, including the written-annual-review amendment, finding the SEC had exceeded its statutory authority. So the standalone requirement that the review be written is not in effect.
That is not permission to skip documentation, and reading it that way is how firms walk into a finding. A separate obligation still applies: the recordkeeping rule requires advisers to make and keep records that document the annual review, and examination staff routinely request those records and treat their absence as evidence the review did not happen. The practical answer for any CCO is unchanged. Document the review, keep the testing and the findings and the corrective actions, and retain them. The written-report mandate went away. The evidentiary reality did not. This is the same logic that governs books and records across the whole program: a review you cannot evidence is a review the SEC will treat as absent.
When once a year is not enough: interim reviews
The word “annual” sets a floor, not a ceiling. The SEC has been explicit that firms should consider interim reviews when something significant happens between annual cycles: a major compliance event, a change in business arrangements, or a regulatory development that affects the firm.
The failure mode here is timing. A firm adds a new service line in March, or triggers custody through a new fee arrangement in June, or acquires another practice in August, and then waits until December to look at whether its policies still fit. By then the gap has been open for months, and every client interaction in that window happened under a policy that no longer described the business. The trigger for a review is a material change, not a date on the calendar. Building that reflex in is far easier when your program lives in one place, which is the practical case for running the annual review inside your RIA compliance management system rather than reconstructing it from scattered files each year.
What the SEC actually finds in annual reviews
In September 2026 the SEC’s Division of Examinations published its observations on adviser annual compliance reviews, and it is the clearest picture available of how these reviews fail in practice. The staff grouped its findings into five areas, and each one maps to a specific bad habit worth checking your own process against.
- Timeliness. Firms that skipped a year entirely, leaving a gap in the sequence. Firms whose reviews stretched well past twelve months, often because a CCO left and no one owned it. And firms that substituted staff training or annual attestations for the review itself, as if collecting acknowledgments counted as testing the program.
- Completeness of the review procedures. Firms whose policies required testing and documentation but never told anyone how to test, what factors to weigh, or what to keep. The review was mandated in the abstract and undefined in the specifics.
- Consistency with their own procedures. Firms that had a defined review process and then did not follow it, including reviews that assessed outdated, already-superseded versions of the policies.
- Alignment with actual practice. The drift cases above, where the review failed to catch that the policies no longer matched what the firm did.
- Documentation and corrective action. Firms that generated real review work, testing, findings, recommended fixes, and then did not retain it. And firms whose reviews recommended changes that were never made, sometimes while the written report claimed the fix had already happened even though the same issue kept recurring.
Read as a group, these are not failures of knowledge. They are failures of ownership and follow-through. The review got started and never got finished, or got finished on paper and never got acted on. That is also why passing a mock audit is not the same as having a working program: a clean dry run means nothing if the findings do not turn into changes.
An RIA annual compliance review checklist
A review that survives an exam is a process with an owner, a scope, evidence, and follow-through. Use this as the spine.
- Define the scope and period. Name every risk area the review will cover and the exact period it covers, and tie the list to your firm’s actual conflicts and business lines, not a generic template.
- Test effectiveness, do not just confirm existence. For each material policy, sample real activity from the year and compare it to what the policy required. Billing, marketing, custody, personal trading, proxy voting, filings, and delegated services are common places drift hides.
- Fold in the three considerations. Work through the compliance matters that arose during the year, any changes in your business or affiliates, and any regulatory changes, and decide what each one requires you to revise.
- Document the work as you go. Keep the testing, the exceptions found, the recommendations, and the reasoning. Treat the record as the deliverable, because to an examiner it is.
- Assign and close corrective actions. Turn every finding into a dated action with an owner, and verify in the next cycle that it was actually done rather than assumed.
- Schedule interim triggers. Decide in advance what events force an off-cycle review, so a mid-year change does not sit until December.
The firms that clear this are not the ones with the longest reports. They are the ones whose review tested real activity, found real gaps, and closed them. Run the review as a living process inside your RIA compliance software and it stops being a December scramble and starts being the thing that makes the exam boring, which is the goal.
Frequently asked questions:
Rule 206(4)-7 under the Investment Advisers Act of 1940, known as the Compliance Rule, requires every SEC-registered investment adviser to adopt and implement written compliance policies and procedures, review them at least annually for adequacy and effectiveness, and designate a chief compliance officer to administer them.
At a minimum, it must consider any compliance matters that arose during the previous year, any changes in the firm’s or its affiliates’ business activities, and any changes in the Advisers Act or applicable regulations. It must also test the effectiveness of the program’s implementation, meaning whether the firm actually did what its policies required.
Adequacy is whether a policy is well designed on paper to prevent the violation it targets. Effectiveness is whether the firm actually followed that policy in practice over the review period. A review must test both, and testing effectiveness requires sampling real activity, not rereading the manual.
Not as a standalone requirement. The 2023 amendment that would have required a written annual review was vacated by the Fifth Circuit in 2024. However, the recordkeeping rule still requires advisers to keep records documenting the review, and examiners treat missing records as evidence the review did not occur, so firms should document and retain the review regardless.
At least once a year. The SEC also expects firms to conduct interim reviews when a significant compliance event, a change in business arrangements, or a regulatory development occurs between annual cycles.
The chief compliance officer, who must be a supervised person of the firm, is responsible for administering the compliance program, including ensuring the annual review is performed, documented, and acted upon.
Based on recent SEC examination observations, the most common problems are late or skipped reviews, review procedures that do not specify how to test, reviews that do not follow the firm’s own process, reviews that fail to catch policies drifting from actual practice, and findings that are documented but never corrected.
