RIA Compliance Technology urges stronger annual RIA review testing

RIA Compliance Technology says small SEC-registered investment advisers should use annual compliance reviews to test whether policies work in practice, document the testing, and track fixes to completion. The guidance lands after an SEC risk alert flagged weak procedures, missing support and corrective actions that were never closed out.

Why it matters: - Small and growing SEC-registered investment advisers can miss problems if annual compliance reviews stop at checklists and attestations. - The review process can show whether policies still fit the firm’s actual operations and whether corrective actions were completed. - Rule 204-2 requires advisers to keep records documenting their annual review.

What happened: - RIA Compliance Technology published a September 20 article, "What to Cover in RIA Annual Compliance Review and How to Document It," focused on how firms should prepare for the next annual review. - The article says firms should gather records that help determine whether written policies still work in practice. - The guidance follows a September 14, 2026 risk alert from the SEC Division of Examinations. - The SEC alert cited incomplete review procedures, assessments that did not match firms’ actual practices, missing supporting documentation, and corrective actions that were recommended but not carried out. - The SEC alert described examination observations and did not create new requirements.

The details: - The annual review should start with the firm’s own business activities. - A new service or a change in marketing to prospective clients may justify a closer look at the affected policies. - The chief compliance officer can define the review scope around those changes while still accounting for the firm’s existing risks and written review procedures. - Using the policy versions that applied during the review period helps keep the assessment tied to what employees were expected to do. - Testing provides the basis for judging implementation. - If marketing is in scope, the reviewer might compare selected advertisements with approval records to see whether the firm followed its review procedure. - Other areas, such as personal trading or customer information safeguards, may require different tests. - The review should match the firm’s business instead of treating every example as mandatory for every adviser. - The supporting record should explain the test performed and connect the results to the final conclusion. - Keeping the underlying materials makes the conclusion easier to revisit later. - The article says advisers should retain the records that document their annual review. - When a review finds a weakness, the firm should assign responsibility and a target date. - Before closing an item, the firm should review evidence of the fix and decide whether more testing is needed. - Open items should remain visible instead of disappearing into the next review cycle.

Between the lines: - The article pushes firms to treat the annual review as a working test of compliance effectiveness, not a paperwork exercise. - For small RIAs, the biggest risk is often not identifying a problem but failing to document the test, the fix, and the follow-through. - Blake Bjordahl said a completed checklist can help track work, but firms still need to assess what the testing showed and whether a problem was actually fixed. - Bjordahl also said an organized record makes it easier to see what is still open and confirm that a correction happened.

What's next: - RIA Compliance Technology says its Simple Compliance Portal supports compliance calendars, procedure testing and task records. - Employee submissions and recorded approvals can help a CCO trace yearlong work and follow assigned corrections. - If a test involves communications or personal trading, firms can use archived records or trading reviews within configured systems. - The firm remains responsible for judging what those records actually show. - RIA Compliance Technology directs readers to the full article and says more information is available on the company’s website.

The bottom line: - The message for small RIAs is simple: test policies against real work, document the result, and keep the correction process open until the fix is verified.