The annual compliance review for a small RIA: what it is and how to run it
The annual compliance review is the yearly check of whether an RIA's written policies and procedures are adequate and working. SEC Rule 206(4)-7 requires an SEC-registered adviser to adopt written policies and procedures reasonably designed to prevent violations, review their adequacy and the effectiveness of their implementation no less than annually, and designate a chief compliance officer to administer them. Rule 204-2 requires keeping records documenting that annual review.
Every December the same thing happens in many small firms: someone remembers the annual review is due, opens the procedures manual for the first time since last December, and tries to reconstruct a year from email. The review gets done, but it mostly measures how good everyone's memory is.
What is the annual compliance review?
It is the yearly check of whether your written policies and procedures still fit the firm and whether they were actually followed. It looks backward at the year and forward at what needs to change.
What does the rule require?
For SEC-registered advisers, Rule 206(4)-7 requires three things:
| Requirement | In plain words |
|---|---|
| Policies and procedures | Written policies and procedures reasonably designed to prevent violations of the Advisers Act and its rules, by the firm and its supervised persons. |
| Annual review | Review, no less than annually, whether those policies are adequate and whether they're being implemented effectively. |
| Chief compliance officer | Name a supervised person responsible for administering the policies. |
Rule 204-2 then requires keeping the policies in effect (and those in effect at any time in the past five years) and any records documenting the annual review. Sources: 17 CFR 275.206(4)-7 and 17 CFR 275.204-2(a)(17).
How do you run it in a small firm?
- List your policies. Every area your procedures cover: billing, trading, personal trading, books and records, privacy, marketing, complaints, vendors and so on.
- For each area, ask three questions. Did anything change this year (business, staff, rules)? Was the procedure followed? Did anything go wrong?
- Test, don't just read. Pick samples: a few bills against agreements, a quarter's personal trading reports, a client file from onboarding to now.
- Record findings. What you checked, what you found, what you'll change, and by when.
- Update the procedures. Keep the old version, date the new one.
A worked example
Take a hypothetical two-person RIA with about 120 households. The owner is the CCO. Over the year, the firm hired an operations assistant, started using a new document storage service, and found one billing error from a missed renewal.
| Area | Changed this year? | Test | Finding and action |
|---|---|---|---|
| Billing | No | 10 bills against agreements | One missed renewal found earlier in the year; renewal step added and confirmed working |
| Personal trading | New access person | All quarterly reports received | Assistant added to the access-person list; reports on time |
| Vendors and privacy | New storage service | Vendor file complete? | Breach-notice commitment missing; requested |
| Books and records | No | Pull one client's full file | Found in under an hour; no change |
The review memo lists what was tested, the four findings, the actions with dates, and the date the procedures were updated.
What should the review record show?
- The date, and who did the review.
- The policies and procedures reviewed.
- What was tested and how.
- Findings, including "no issues" where that's true.
- Actions, owners and dates, and when each was completed.
When is this overkill?
A solo adviser doesn't need a 40-page report. A short memo that covers each area, shows what was tested and lists what changed is enough to show the review happened and meant something. The size of the memo should match the size of the firm.
How Advorra fits
Advorra keeps the records an annual review draws on in one place: the procedures vault, policies, incidents and complaints log, personal-securities log, brochure-delivery log, the suitability-review clock and billing runs. That makes the "test, don't just read" step faster. See the product page, or read a compliance calendar for small RIAs and written procedures.
One thing to do this week: put the annual review on your calendar now, with a date in the first half of the review month, not the last week.
A plain summary of public rule text, not legal or compliance advice. Your CCO and compliance consultant decide how your firm's review is run. State-registered advisers should check their state's requirements.
Questions advisors ask
Who runs the annual review?
Usually the chief compliance officer, even in a one-person firm where the owner holds that title. Some firms bring in a compliance consultant to help or to review independently.
How long should the review take?
It depends on the firm's size and how well records were kept during the year. A firm that logged things as it went spends its time reviewing, not searching.
Does the rule say what the review must cover?
The rule says to review the adequacy of the policies and procedures and the effectiveness of their implementation. What that covers for your firm is a question for your CCO and compliance consultant.
What if the review finds problems?
Record them, fix them, and note what changed. A review that finds and fixes issues is more credible than one that finds nothing.
Does this apply to state-registered advisers?
Rule 206(4)-7 is the SEC rule. State-registered firms should check their state's requirements.
See it on a demo firm
Advorra is practice software for independent RIAs: clients, models, IPS, billing and compliance records in one place, on top of the custodian you already use. Built by The CollabHub.
Get in touch