The GIPS compliance requirements are the duties a firm takes on when it claims compliance with the Global Investment Performance Standards: apply them firm-wide, show at least five years of compliant history (or since inception), document policies and procedures and apply them consistently, put every fee-paying discretionary segregated account in at least one composite, give a GIPS report to every prospective client and update it every 12 months, correct material errors under a written policy, and notify CFA Institute every year with figures as of 31 December. Verification is recommended rather than required. None of these scale down for a small firm, and at a small firm they usually rest on one person. Botminds' GIPS Compliance Reporting tests composite membership, statistics and reports and files the evidence where a verifier will look, so that one officer decides and signs instead of searching.
This guide is for the performance or compliance lead who holds the claim at a small or mid-sized manager, and for the chief operating officer deciding how to staff it. Provisions are cited from the 2020 GIPS Standards for Firms; the examples come from the solution's sample data on a fictional firm, Quillfield Capital, whose GIPS Compliance Officer is a fictional Ruth Adeyemi.
What one GIPS officer holds at the sample firm in one quarter
80
composites to close for the quarter
1,846
composite membership events tested in nine months
121
GIPS reports to issue for the quarter
146
lines on the verifier's request list
What are the GIPS compliance requirements?
The requirements are the "must" provisions of the 2020 GIPS Standards for Firms, and the first of them sets the scale: "The GIPS standards must be applied on a firm-wide basis. Compliance must be met on a firm-wide basis and cannot be met on a composite, pooled fund, or portfolio basis" (GIPS Standards for Firms, 1.A.1). A small firm cannot claim compliance for its flagship strategy alone; every strategy offered as a segregated account needs a composite, and "all actual, fee-paying, discretionary segregated accounts must be included in at least one composite" (3.A.2).
The rest fall into eight standing duties, each with a provision behind it. Read a GIPS policies manual beside the standards and almost every duty traces back to one of these lines, which makes the list a fair map of what the firm's officer is accountable for.
The GIPS compliance requirements, and what goes wrong when nobody owns one
| Requirement | Provision | What goes wrong without an owner |
|---|---|---|
| Keep written policies, apply them consistently, and track changes to the standards and the law | 1.A.5, 1.A.6 | Decisions drift from the policy; a verifier finds the manual out of date |
| Maintain composite definitions and the complete list of composite descriptions | 1.A.22, 3.A.5 | A terminated composite drops off the list early; a new strategy has no composite |
| Decide new, terminated and moved portfolios, and removals for cash flows or minimum size | 3.A.7–3.A.12 | Removals with no reason on file |
| Prepare and review GIPS reports: numbers and disclosures | Section 4 (and 6 for pooled funds) | A disclosure that should have stayed a year disappears |
| Give every prospect the right report, updated every 12 months | 1.A.11, 1.A.12, 1.A.17 | No record of who received which version |
| Run the error correction policy | 1.A.20, 4.C.38 | A material error reaches people who are never told |
| File the GIPS Compliance Notification Form | 1.A.38 | The 30 June deadline passes |
| Choose and work with the verifier, including its independence | 1.A.39; GIPS Standards for Verifiers | A request list answered from memory |
Two requirements catch small firms more often than the rest. The prospect duty is a distribution duty: the firm "must not choose to which prospective clients it presents a gips composite report" (1.A.11), and must "demonstrate how it made every reasonable effort" to provide one (1.A.17), which puts the sales team's contact list inside the compliance perimeter. And the records duty is absolute: "All data and information necessary to support all items included in gips composite reports ... must be captured, maintained, and available within a reasonable time frame, for all periods presented" (1.A.25).
How does a small firm become GIPS compliant?
A small firm becomes GIPS compliant by defining the firm, writing its policies, building composites over at least five years of history, producing compliant reports and filing the notification form, usually followed by a verification. The five years are the hard part: "the firm must attain compliance for a minimum of five years or for the period since the firm inception if the firm has been in existence for less than five years" (1.A.3), so a firm with a long history must rebuild composite membership for periods in which nobody was recording the reasons.
Becoming GIPS compliant: the steps, in the order that saves rework
| Step | What the firm decides or produces | Provision |
|---|---|---|
| 1. Define the firm | The investment firm, subsidiary or division held out to the public as a distinct business | 1.A.2 |
| 2. Write the policies and procedures | Composite construction, cash flows, minimums, errors, distribution, records: the firm's own manual | 1.A.5 |
| 3. Build the composites | Definitions for every strategy, and every fee-paying discretionary segregated account placed | 3.A.1, 3.A.2 |
| 4. Reconstruct the history | At least five years, or since inception, with membership and returns that the policies would produce | 1.A.3 |
| 5. Produce the reports | One GIPS report per composite, numbers and disclosures | Section 4 |
| 6. Notify CFA Institute | The notification form, then annually with data as of 31 December | 1.A.38 |
| 7. Be verified | Recommended, not required; many prospects and consultants ask for it | 1.B.3 |
The policies manual is where a small firm saves or loses the most time. CFA Institute's guide is direct that there is no shortcut: "Policies and procedures are unique to a firm – there is no 'one size fits all' template", and while outside help is fine, the manual "must be designed for the specific firm" (CFA Institute, guide for policies and procedures, 2023). A borrowed manual that describes a significant cash flow policy the firm does not apply is a finding waiting for the verifier; how to set those thresholds is worked through in GIPS significant cash flow policy: how big is significant?
Can one person run GIPS compliance at a small firm?
One person can do the work at a small firm; one person cannot check it. The standards name no role and no team size. CFA Institute's guide asks firms to "identify personnel, or those who hold certain job titles or positions at the firm, who will be responsible for developing and maintaining the policies and procedures and for ensuring that all applicable requirements are being followed", and expects that "several areas within the firm (accounting, legal and compliance, investment operations, risk management, marketing, etc.) will need to be involved" (CFA Institute, 2023).
The guide's sample manual assumes a GIPS Standards Oversight Committee that "meets quarterly and includes representatives from performance, portfolio management, operations, compliance, marketing, risk, and client service", but adds that "all firms may not have a GIPS Standards Oversight Committee". At a small firm the committee is often one officer wearing five hats, and that is workable if the hats are written down and the decisions that matter have a second signature.
One GIPS officer, five roles: what each looks like by hand and with agents
Today
Keeps the policies manual and every composite definition current, and remembers which version applied in which month.
With agents
Reviews the gaps the Policy agent lists against the 2020 standards, and the impact preview of each proposed change.
Still theirs: Writes the policy; approves changes with the Head of Performance.
Today
Matches custodian statements and client letters to composite removals, often weeks after the event.
With agents
Sees only the events the rules or the agents cannot settle, with both readings and the governing clause.
Still theirs: Decides exceptions and signs each with a reason code.
Today
Recomputes internal dispersion and the three-year standard deviation in spreadsheets.
With agents
Receives each difference from a published figure as a question, with the error policy applied.
Still theirs: Decides what the error policy says to do.
Today
Rebuilds each GIPS report and checks its disclosures line by line.
With agents
Reads a redline against the last signed version, held until the composite's questions close.
Still theirs: Signs reports she did not prepare.
Today
Answers the verifier's request list by email, one search at a time.
With agents
Approves cited draft replies and sample files; a liaison releases them.
Still theirs: Owns what the firm tells its verifier.
Size the GIPS function by events, not by assets
The workload of GIPS compliance follows the number of events the policies must decide, not the assets under management. Count the membership events a year (joins, terminations, removals for significant cash flows or minimums, moves between composites), the report versions issued, the prospects who receive them, and the lines on the verifier's request list. A firm with few composites and stable mandates can run on a fraction of one person; a firm with frequent large client flows needs more, whatever its size.
At the sample firm, 80 composites and 3,412 portfolios produced 1,846 membership events in nine months, 121 GIPS reports a quarter and a 146-line request list. With the agents testing each event against the written policy overnight, 1,823 of those 1,846 were documented with their reason and sources, and 23 came to the officer as questions. Those are figures from fictional sample data; the point is the ratio. The officer's time goes to the cases the policy cannot settle by itself.
The GIPS year for a small firm, month by month
The GIPS calendar has two fixed points from the standards, the notification form and the 12-month report refresh, and softer ones set by each firm's policy. For a one-officer firm the fixed points are the risk, because nobody else is watching them.
A GIPS officer's year: the fixed deadlines and the work around them
- Year-end reportsJan–Feb
- Notification form; annual verificationMar–Jun
- Refresh; policy reviewJul–Sep
- Refresh; interim fieldworkOct–Dec
Between the fixed points the work is continuous. Every new account, termination and large client flow is a membership event that needs a decision under the policy, and every quarter-end produces new report versions. The prospect duty reaches into sales: updated reports go to prospects who are "still a prospective client" (1.A.12), and whether someone still is a prospect is usually a sales judgment the compliance officer has to collect and keep.
Can GIPS compliance be outsourced?
The work can be supported from outside; the claim cannot be handed over. "The firm is responsible for its claim of compliance with the GIPS standards and must ensure that the records and information provided by any third party on which the firm relies meet the requirements of the GIPS standards" (1.A.26). A small firm can hire a consultant to draft its manual, a fund administrator to calculate returns and a verifier to test the result, and it still owns every decision behind the report.
What a small firm can buy in, and what stays with the firm
Can be supported from outside: A first draft, gap review against the 2020 standards.
Stays with the firm: The policy itself: it must describe what the firm actually does.
Can be supported from outside: Calculation by an administrator or a performance system.
Stays with the firm: Checking the figures and deciding what the error policy requires.
Can be supported from outside: Data feeds and rule-based tests.
Stays with the firm: Every exception and its reason.
Can be supported from outside: The verifier's testing, which must be independent of the firm.
Stays with the firm: Answering the request list and owning what the verifier is told.
Can be supported from outside: Nothing.
Stays with the firm: All of it (1.A.26).
Key-person risk: when the claim lives in one inbox
The risk in a one-officer GIPS function is not that the officer makes mistakes; it is that the support for correct decisions exists only in that officer's memory and inbox. Provision 1.A.25 requires the opposite, and verification tests it: the verifier's work starts from whether the firm's records support what it published. The test for a chief operating officer is simple. If the officer were away for the verifier's fieldwork, could someone else answer the request list from what is on file?
A removal whose reason is a remembered phone call fails that test. So does a policy version kept on a personal drive, a distribution list in a salesperson's email, or an error decided in a hallway conversation. A material error is where it hurts most, because the correction has to reach every client, verifier and prospect who received the wrong report (1.A.20), and the true reach of one material error shows how far that list runs when nobody kept it.
What must live in a system, not in one person's inbox
- Every version of the policies manual, with effective dates
So anyone can say which rule applied in which month.
- A reason and a source for every membership event
The client's instruction and the custodian's record, attached when the decision is made.
- Who decided, when, and who approved
With the approver different from the preparer for the decisions that matter.
- Every GIPS report version and its recipients
The list a correction or an annual update has to reach.
- The error log and each incident report
What was found, how it was measured, what was done.
- Notification filings and their receipts
One a year, by 30 June.
- The verifier's requests, the answers and what was released
So next year's engagement starts from the last one.
A second signature for the decisions that matter
The standards do not require maker-checker review, but a one-person function that prepares, reviews and signs every decision leaves no second view, and verifiers test whether policies were applied consistently. A small firm does not need a second GIPS specialist to fix that. It needs a named second approver, often the head of performance, the chief compliance officer or the chief operating officer, for three kinds of decision: a change to the policies or a composite definition, a material error and its correction, and the release of each GIPS report.
CFA Institute's sample policy shows one way to split it: the performance department prepares reports, the performance manager reviews them and the compliance department gives the final review (CFA Institute, 2023). At a firm of twenty, those may be two people rather than three departments; the point is that the person who prepared a report is not the only one who saw it.
How GIPS Compliance Reporting supports a one-officer firm
GIPS Compliance Reporting moves the searching and recomputing to agents and leaves the officer with the decisions the policy cannot make by itself. At the sample firm, on business day 13 of a 15-day quarter close, seven sign-offs waited for the officer, 61 of 80 composites were closed and 131 of 146 verifier requests were ready. Overnight the agents had tested 1,846 membership events and documented 1,823 with their reason and sources.
The GIPS officer's morning: only what she must decide, with its due date
Each decision she signs is filed where the verifier will look, with the reason code, a second agent's blind re-test and the source documents. The preparer cannot approve their own work, and a policy or composite definition change waits for two approvals. That is what lets a one-person department survive a holiday, a resignation or a verifier's question about a decision made in March. How the agents decide what to ask rather than guess is set out in GIPS performance reporting with agents that ask.
A membership decision signed once and filed for the verifier
The officer still owns the claim: she writes the policy, decides every exception, signs every report she did not prepare and approves what the verifier sees. The solution and its agents are on the GIPS Compliance Reporting page.
Questions people ask
How many years of history does GIPS compliance require?
At least five years, or since inception if the firm is younger (1.A.3). After the initial claim the firm adds each year's performance, building toward at least ten years of compliant history in each composite report (4.A.1). The five years must be rebuilt under the firm's written policies, which is why the manual should come first.
Is GIPS verification required?
No. The 2020 standards say "the firm should be verified" (1.B.3), a recommendation, not a requirement. Many consultants and institutional prospects ask for a verification report all the same, which is why the verifier's request list is part of most GIPS officers' year.
Do GIPS requirements differ for small firms?
No. Compliance must be met firm-wide (1.A.1), and every provision applies whatever the firm's size. What differs is the structure: CFA Institute's guide notes that not every firm will have a GIPS oversight committee, so at a small firm the duties are usually held by one or two people.
When is the GIPS Compliance Notification Form due?
By 30 June each year, with information as of the most recent 31 December, except contact details, which must be current when the form is filed (1.A.38). It is also filed when the firm first claims compliance.
Can a small firm claim GIPS compliance for one strategy only?
No. Compliance "cannot be met on a composite, pooled fund, or portfolio basis" (1.A.1), and every fee-paying discretionary segregated account must sit in at least one composite (3.A.2). A firm can, however, define itself narrowly, as a division held out to the public as a distinct business (1.A.2).
What happens to GIPS compliance when the officer leaves?
The obligations continue unchanged: the notification form is still due by 30 June and prospects still need updated reports within 12 months. Whether the next person can carry on depends on whether policies, decisions and evidence were kept where others can find them (1.A.25).