An RIA annual compliance review checklist should cover the five areas where the SEC's Division of Examinations found advisers falling short in its risk alert of 14 September 2026: doing the review on time, having written procedures for it, following those procedures, checking that policies match what the firm actually does, keeping the documentation, and fixing what the review finds. Inside the fourth area sits a question most reviews answer by assertion: did every rule change in the year reach the right policy and the right coded compliance rule? It can be measured, by having a second reviewer re-decide a sample of the year's publications without seeing the first decisions. Botminds' Regulatory Change Management for Asset Managers keeps every call, its reason and its approver in one register, which turns that test from a project into a query.
This guide is for the CCO of a registered investment adviser and whoever runs the review. Quotations are from the SEC's risk alert and rules, linked where they appear; the risk alert states staff views, not rules. Examples use the solution's fictional sample firm, Quillfield Capital.
The annual review, as the SEC staff found it in 2026
5
areas of weakness in advisers’ annual reviews named in the September 2026 risk alert
12
months: the longest gap the rule allows between reviews, with no 18-month first review for new registrants
2
rule changes the staff saw reviews miss: the Marketing Rule and Form CRS filing
27
SEC proposed-rule documents from January to 27 October 2026 that a 2026 review period must account for
What did SEC examiners find when they read annual reviews?
The staff grouped its observations into five issues: whether reviews happened on time, whether advisers had complete procedures for doing them, whether the reviews matched the advisers' own policies and actual practices, whether the documentation was made and kept, and whether corrective actions were carried through (SEC risk alert, 14 September 2026). The examples under each are specific enough to turn into checklist lines, which the table does.
From the SEC staff’s 2026 findings to a checklist line
| What the staff observed | Example in the risk alert | Checklist line it becomes |
|---|---|---|
| Reviews not done on time | Gaps such as reviews for 2021 and 2023 "but omitting 2022"; first reviews 18 months after registration; training or attestations offered instead of a review | Review dates for the last three years, none more than 12 months apart |
| No written procedure for the review | Policies required testing but gave no direction on the tests, the factors to weigh or the documentation to keep | A review procedure naming scope, tests, factors and work papers |
| Review not done the way the procedure says | Reviews that assessed superseded versions of policies | Each tested policy is the version in force during the period |
| Policies not matching practice | Fee billing, proxy voting and custody practices that differed from policy; marketing and Form CRS procedures not updated for new rules | Every rule change in the period traced to a policy and, where relevant, a coded rule |
| Documentation not kept | Testing and corrective-action papers created but not kept; required written reports never prepared | Work papers filed under Rule 204-2(a)(17)(ii) |
| Corrective actions not taken | Reports saying fixes were made while the issues "persisted" | Each prior finding re-tested, not re-asserted |
Rule 206(4)-7 annual review requirements: what the rule says
The rule itself is short. An adviser must review, at least once a year, the adequacy of its policies and procedures and the effectiveness of their implementation, and must designate a chief compliance officer who is a supervised person (17 CFR 275.206(4)-7); the books-and-records rule adds that the documents of that review must be kept (17 CFR 275.204-2(a)(17)(ii)). The rule prescribes no format, no length and no tester.
What fills the gap is the 2003 adopting release, which the risk alert relies on: the review should consider compliance matters from the year, changes in the adviser's business, and changes in the Advisers Act and the rules under it that might call for a revised policy. The last of those is the regulatory change process, inspected once a year. The SEC's fiscal 2027 priorities say examiners will typically look at the annual review itself (SEC, FY2027 Examination Priorities), so the review is now read as evidence, not just performed.
The RIA annual compliance review checklist
Fourteen lines, in the order a reviewer can work through them. Lines 7 to 9 are the regulatory change test that most reviews treat as a single tick.
RIA annual compliance review checklist, built on the SEC’s 2026 findings
- Period and timing
The review covers a defined 12-month period, starting where the last one ended, with no gap year.
- A written review procedure
Scope, tests per area, the factors to weigh, and the work papers to keep.
- The right versions
Each policy tested is the version in force during the period; superseded versions are noted.
- Business changes
New strategies, funds, entities, service providers and staff changes since the last review, each with its effect on scope.
- Compliance matters from the year
Breaches, errors, complaints and exam findings, each with its root cause.
- Core areas tested, not attested
Marketing, valuation, trading, portfolio management, disclosure and filings, custody, code of ethics; tests, not staff sign-offs.
- Every final rule and compliance date in the period
Listed from the regulator’s own publications, each traced to the policy it changed, or a reason it changed none.
- Every coded rule affected
Where a change set a limit or a test, the compliance engine rule and its tested version.
- A blind second look at a sample
A second reviewer re-decides relevance and scope for a sample of the year’s publications; disagreements are resolved and counted.
- Dates that moved
Each extension in the period, with the re-plan and who approved it.
- Delegated work
How the adviser oversees service providers and delegates, including notice duties under Regulation S-P.
- Prior findings re-tested
Each corrective action from last year shown to be working, with evidence.
- A written report
Findings, recommendations and material changes, delivered to the people who must act.
- Work papers kept
Tests, samples and results filed as books and records, retrievable for an examiner.
How do you test that every rule change was caught?
Rebuild the year's population from the regulators' own publications, not from the change register, then compare. If the test starts from the register it can only confirm what the register already contains; the misses are, by definition, not in it.
A five-step test of the year’s regulatory change process
A person decides
Rebuild the populationList every final rule, compliance date, staff statement and date change in the period from each regulator on the source list, using the regulator’s own pages and the Federal Register.
A person decides
Match to the registerMark each item as handled, handled late or missing; for missing items, find where the process lost it: source, triage, scope or owner.
A person decides
Blind second review of a sampleA second reviewer, who did not make the original calls, decides relevance and fund scope for a sample of items without seeing the first answers.
A person decides
Resolve and countEvery disagreement is resolved against the text by a third person; count the disagreements, and the original calls that turned out wrong.
A person decides
Fix the causeA missing source joins the list; a recurring scope error becomes a test; each fix is a corrective action for next year’s review to re-test.
The population step is easier than it sounds for US rules: the Federal Register API returns every SEC document by type and date, and its counts for 1 January to 27 October 2026 were 16 final rules, 27 proposed-rule documents and 2,070 notices (Federal Register API). Non-US regulators need their own source lists. The test should include rules whose compliance date fell in the period, such as the Regulation S-P amendments, whose compliance date for smaller entities was 3 June 2026 (89 FR 47688), not only rules published in it.
Two reviewers, two answers: measuring agreement on rule changes
Relevance and scope are judgements, so two competent reviewers will sometimes disagree, and the disagreement is the measure. No regulator or independent study publishes a typical agreement rate for regulatory change triage; the figure that matters is your own, tracked year on year. Report three numbers: how many items the rebuilt population found that the register did not, how often the blind reviewer disagreed on relevance, and how often on fund scope.
A firm that already has two independent checks in its process can report them from the register. On the solution's fictional sample firm, a second agent re-tests every applicability call with a separate model, and in the third quarter of 2026 the agents disagreed on 9 fund calls out of the 41 changes Legal approved; a person decided each with a reason. Those disagreements are where a reviewer should start.
From 912 publications to 9 disputed fund calls in one quarter
How big a sample of “not relevant” items does the review need?
Big enough that a real problem would show. The items ruled not relevant are where a missed change hides, and they are too many to re-read in full: the sample firm ruled 794 of 912 publications not relevant in one quarter. Simple probability gives the size. If a share p of those calls is wrong, a random sample of n items contains no wrong call with probability (1 − p)n; setting that at 5% gives the sample needed to be 95% sure of seeing at least one.
Sample of “not relevant” calls needed to be 95% sure of catching at least one wrong call
| If the true share of wrong calls is | Items to re-decide blind | Share of one quarter at the sample firm |
|---|---|---|
| 10% | 29 | about 4% of 794 |
| 5% | 59 | about 7% |
| 3% | 99 | about 12% |
| 2% | 149 | about 19% |
| 1% | 299 | about 38% |
Two practical points follow. Stratify the sample by regulator and language, because misses cluster where the reading is hardest: a sample drawn only from English-language US items says nothing about the Luxembourg circulars. And keep the sample in the work papers, with each blind decision and its resolution, so next year's reviewer can see what was tested and the examiner can see the method.
Annual compliance review report: a template outline
The report is the document an examiner will read, so it should say what was tested and what was found, not what the policies say. The staff saw advisers whose procedures required a written report that was never prepared, and reports stating fixes "were already implemented" while the problems remained (SEC risk alert, 14 September 2026).
Annual compliance review report: sections and what each must contain
| Section | What it contains |
|---|---|
| 1. Period, scope and method | The 12 months covered, the areas tested, who tested them, and the procedure followed |
| 2. Changes in the business | New funds, strategies, entities, service providers and key staff, and how each changed scope |
| 3. Regulatory changes | Every final rule and compliance date in the period, how each was handled, the test results and the misses |
| 4. Findings by area | For each core area: tests run, sample sizes, exceptions found, root cause |
| 5. Prior-year actions | Each corrective action, re-tested, with evidence it works |
| 6. Recommendations and owners | Each recommendation with an owner and a date |
| 7. Work papers | Index of the files kept under Rule 204-2(a)(17)(ii) |
Who performs the annual compliance review?
The chief compliance officer is responsible, and usually runs it with compliance staff, sometimes with an outside consultant for particular areas. The rule does not require independence, but the test is more credible when the person testing an area did not run it during the year. For the regulatory change section that means the blind second reviewer is not the analyst who triaged the items.
Agents change the division of labour, not the responsibility. In the solution, the register and the quarterly summaries that feed the review are drafted by an agent and reviewed by the change manager before the CCO signs; the review itself remains the CCO's.
The quarterly summary that feeds the annual review, waiting for its sign-offs
When is an interim compliance review needed?
When something happens that could make a policy inadequate before the next annual review: a significant compliance event, a change in business arrangements, or a regulatory development. The September 2026 risk alert repeats the 2003 release's expectation that advisers consider interim reviews for all three. A new rule with a compliance date inside the year is the clearest case, because waiting for the annual review would mean testing the policy after the date it had to change.
The change register is the trigger list. Each final rule, each compliance date and each moved date is a candidate for an interim review of the policies it touches, and the reason for not doing one should be written down. The seven steps behind each item are set out in the regulatory change management process, and the fields that make an item testable in the compliance obligations register template.
The decision and its reason, ready for the reviewer to sample
To see a year's register and quarterly summaries on your own regulators, start from Regulatory Change Management for Asset Managers.
Questions people ask
Is an annual compliance review required for every SEC-registered adviser?
Yes. Rule 206(4)-7 requires every adviser registered with the SEC to review its policies and procedures at least annually, and Rule 204-2 requires it to keep the documents of that review. Registered funds have a parallel requirement under Rule 38a-1, which the September 2026 risk alert does not cover.
Can staff attestations replace the annual review?
No. The risk alert describes advisers that treated compliance training or annual attestations of staff adherence as their review, and lists them among the cases where the required review was not performed. Attestations can be one input; tests are the review.
How long after registration is the first annual review due?
Within twelve months. The risk alert explains that the 18-month allowance in the 2003 release applied only when the compliance rule first took effect in 2004, and it observed advisers that waited 18 months after registering.
What sample size should the regulatory change test use?
No regulator sets one. Include every final rule and compliance date in the period, plus a random sample of items ruled not relevant: about 99 items gives a 95% chance of catching at least one wrong call if 3% of them are wrong. Record the sample size and how it was drawn in the work papers.
Does the annual review have to be in writing?
The rule requires the review and the records documenting it, and the risk alert criticised advisers whose own procedures required a written report that was never prepared. In practice a written report, with work papers, is the only form an examiner can assess.
What is the difference between an annual review and an interim review?
The annual review covers the whole program for a year; an interim review covers the policies touched by a specific event, such as a new rule, a business change or a compliance failure, when it happens. Interim reviews done during the year make the annual review shorter and its findings older.