Investment compliance testing requirements: re-test on every change

Investment compliance testing requirements, for a US adviser, rest on Rule 206(4)-7: written policies and procedures "reasonably designed to prevent violation" of the Advisers Act, a review "no less frequently than annually" of their adequacy and "the effectiveness of their implementation", and a chief compliance officer to administer them (17 CFR 275.206(4)-7); funds have the parallel Rule 38a-1. Applied to coded investment restrictions, effectiveness has a precise meaning: the rule in the engine still matches the clause in force, on today's data. That is not a once-a-year question, because documents, classifications and regulations change all year, and a rule that was right in January can be wrong by March without anyone touching it. Botminds' Compliance Rule Coding treats every such change as a trigger: its agents find each rule the change touches, re-test it across the portfolios that carry it, and bring the analyst only the results that change.

Rules and regulator findings are linked where they appear; the solution's figures are its fictional sample data.

What are the investment compliance testing requirements?

There is no rule that says "back-test every coded restriction monthly". The requirements are principles, and each translates into a concrete test for coded rules. Policies and procedures must be reasonably designed to prevent violations: the rule set must cover every restriction that binds each portfolio. Their implementation must be effective: each rule must do what its clause says on real data. They must be reviewed at least annually: someone must check that both are still true and record that they did. And records of that review must be kept: the books-and-records rule requires advisers to keep "any records documenting the investment adviser's annual review" (17 CFR 275.204-2(a)(17)(ii)).

Funds add a board. Under Rule 38a-1 the fund's chief compliance officer reports to the board in writing at least once a year on the operation of the fund's and its service providers' policies and on each material compliance matter since the last report (17 CFR 270.38a-1(a)(4)(iii)). A coded rule that let a breach through, or a rule the review found out of date, is the kind of matter that report exists for.

Rule 206(4)-7 annual review requirements, applied to coded rules

The SEC set out in 2003 what the annual review should look at: compliance matters that arose during the year, changes in the adviser's business, and changes in the Advisers Act or applicable regulations that might call for revised procedures; it added that advisers should consider interim reviews when significant compliance events, business changes or regulatory developments occur (Compliance Programs of Investment Companies and Investment Advisers, 68 FR 74714, December 24, 2003). Each of those three maps directly onto coded rules.

What did the SEC find in annual compliance reviews?

In September 2026 the SEC's Division of Examinations published what its staff observed in advisers' annual reviews, grouped under five issues: reviews that were late or skipped, review procedures that were incomplete, reviews that did not match the advisers' own policies and practices, documentation that was not made or kept, and corrective actions that were recommended but never taken (SEC risk alert, September 14, 2026). Three of the observations read like descriptions of a stale rule library.

Some reviews "assessed the effectiveness of incorrect documents, such as outdated versions of policies and procedures". Some advisers' policies required "testing and validation" as part of the review, but the advisers "did not document procedures providing direction and processes personnel should follow for the tests and validations". And some reviews missed "Incidents of non-compliance, which were identified and reported during the review period, but were not addressed or recorded in the annual reviews". For coded restrictions the parallels are exact: rules tested against a superseded agreement, testing required but never defined, and breaches investigated in monitoring that never reach the review of the rule that caused them.

Investment adviser compliance testing: what examiners ask to see

Examiners ask for the review, the testing behind it and the tools that ran it. The SEC's FY2027 priorities say examinations will review key components of an adviser's compliance program, naming portfolio management and disclosure and filings among them, and "will also typically analyze an adviser's annual compliance review" (SEC Division of Examinations, Fiscal Year 2027 priorities). For funds, the staff's typical request list includes the compliance policies with their inventories of risks, testing and exception reports, the chief compliance officer's annual reviews, and information about the systems used for compliance oversight (SEC risk alert, November 4, 2024).

In its review of fund deficiencies, the same 2024 alert recorded funds that kept going over the investment thresholds they had disclosed, and others that did not "test for compliance with exemptive orders and derivative segregation requirements (when applicable)". Both are failures a re-test programme for coded rules is designed to catch: a threshold breached repeatedly is often a threshold coded wrongly, and a requirement nobody tests is a rule nobody can show works.

What triggers a re-test of a coded rule?

Any change to something the rule depends on: its clause, its defined terms, its data, its engine, or the law behind it. Most of those changes arrive from outside compliance and many do not mention the rules they affect, which is why the triggers have to be listed in advance and watched.

Two of the eight are easy to miss because nothing in the documents changes. A benchmark reclassification changes which issuers a rule counts without touching a single clause. A data vendor that revises how it assigns country of risk changes the result of every rule that uses the field. Both can move a portfolio across a limit overnight, and neither is a breach anyone caused, which makes it more important to find before the engine does. The Names Rule is the clearest regulatory example: its 80% basket must be reviewed "at least quarterly" under the amended rule, whatever else changes, and its compliance dates themselves moved by six months; the Names Rule compliance date guide covers those moves in full.

How often should investment restrictions be re-tested?

On every trigger, and in full on a fixed cycle. No regulator sets the cycle; the managers the AMF inspected chose their own. Three of the five ran a periodic consistency review of all the ratios configured for their funds: every two years at one, every six months at another, and every time the prospectus was updated at a third. The AMF listed that review as good practice, along with an automated audit trail of every creation or change of a ratio in the control tool (AMF SPOT summary, sections 4.3.2 and 4.3.6).

It also named the failure on the other side. Among its poor practices: "Not carrying out a periodic a posteriori review of changes to the configuration of investment ratios during the previous period", and "Not using 4-eye checks when creating or modifying ratios in pre-trade and post-trade control tools". One manager reviewed its configuration changes every half year. The lesson for a cycle is that a full re-test once a year should be a confirmation, not the first time anyone looks; the trigger-based re-tests during the year do the real work.

Configuration changes: the trigger inside the firm

The most dangerous change is the one compliance makes itself. Every edit to a rule, whether a fixed typo, a raised warning level or a re-mapped data field, is a new rule that has not been tested. The AMF's managers restricted write access to the configuration function to the risk control team, and two gave portfolio managers read-only access to the configuration (AMF SPOT summary, section 4.1.2). Restricting who can change a rule is the first half; re-testing and checking every change is the second.

The same applies to the tools. A new engine release, or a new version of an agent that drafts or tests rules, can change results without any document changing. In the solution, every rule records the versions of the agents and models that drafted, read and tested it, and a new agent version goes live only after a golden set of 1,140 coded clauses passes and a second administrator approves.

One benchmark announcement, 64 rules re-tested, three results that change

An investment compliance testing program for coded rules

A testing program for coded rules has four parts: a list of triggers with an owner for each, a re-test standard for each kind of change, a full cycle, and the records that prove all three happened. It belongs inside the firm's written procedures, so that the annual review can test it like any other procedure, and it should name what happens when a re-test fails: who decides, who signs, and how fast the corrected rule loads.

How Compliance Rule Coding re-tests after a change

The solution watches the sources of change and works from the rule library. When an amendment, supplement, list update, reclassification or regulatory change arrives, the agents find every live rule it touches through each rule's citations and data mappings, re-test each across the portfolios that carry it, and bring only the results that change. The analyst decides what to do; a different officer checks; the package is dry-run and released as for a new mandate. In the sample, about 2,000 changes a year flow through that path, with a service level of five business days from receipt to load.

The library also carries the evidence an annual review needs. Every live rule shows its clause, its versions, its signatures and its last test, and rules with no clause are visible as such: 89 of 6,412 on the sample firm, all coded before 2022, with citations proposed by the Evidence agent for 83 and a person approving each one.

Every live rule with its clause, and the legacy rules that have none

How a single re-test is read is worked through in backtesting compliance rules; how fund policies differ in what it takes to change them is the subject of 1940 Act fundamental policies. To see changes found, re-tested and decided on a sample library, start from Compliance Rule Coding.

Questions people ask

Does Rule 206(4)-7 require testing of compliance rules?

It requires an annual review of the adequacy of the adviser's policies and procedures and the effectiveness of their implementation, which in practice means testing. The rule does not prescribe how; the SEC's 2026 risk alert criticised advisers whose policies required testing and validation without saying how it should be done or documented.

Is an annual review enough for coded investment restrictions?

Rarely on its own. Documents, classifications and regulations change during the year, and the SEC's 2003 release said advisers should consider interim reviews after significant events and regulatory developments. Trigger-based re-tests during the year, with an annual full review as confirmation, match how the rules actually change.

What records should a re-test leave?

The trigger and its date, the rules it touched, the test results before and after, the decision and who made it, the checker's signature and the load. Advisers must keep records documenting their annual review under Rule 204-2(a)(17)(ii), and a re-test record is the raw material for that review.

Who owns re-testing: compliance or operations?

Compliance owns the decision and the sign-off; operations and data teams own many of the triggers. The AMF found the configuration of limits sitting with the risk control function at all five managers it inspected, with write access restricted to that function, which is a reasonable model for who may change and re-test a rule.

How does the Names Rule change re-testing for US funds?

It adds a fixed cadence: a fund must review its investments' inclusion in its 80% basket at least quarterly, keep records of the review, and return to compliance within 90 consecutive days of identifying a shortfall. Large fund groups have had to comply since 11 June 2026; smaller groups follow on 11 December 2026.