What It Means for Investment Advisers
Overview
Listen
In this Conversation, we unpack the SEC’s recent Risk Alert on annual compliance reviews and why relying on a once-a-year checkup leaves firms exposed to drift between written policy and actual practice. We look at how that misalignment sets off a chain reaction across documentation, corrective actions, and review consistency. Then we talk through how Red Oak’s Mira builds policy from a firm’s own handbook rather than a generic standard, with continuous monitoring keeping that policy aligned with practice as it evolves.
Critical Questions Powered by Red Oak
Transcript
Read the Blog Post
Financial firms are used to running communications compliance reviews day-to-day, but the SEC’s Compliance Rule – Rule 206(4)-7 – asks for something separate: a step back to assess the firm’s entire compliance program at least once a year. That review has to weigh two things: whether the firm’s policies and procedures are adequate for its current business, and whether they’re actually being followed. The rule exists because a firm’s business changes, regulations change, and a compliance program written two years ago may no longer match what the firm does. The annual review is meant to catch that gap before a client or an examiner does.
The Division uses Risk Alerts to publish patterns its examiners have spotted across firms, giving the industry visibility into where reviews commonly fall short. This one grouped its findings into six categories:
- Policies not aligned with actual practice
- Untimely or missing reviews
- Incomplete review procedures
- Reviews not conducted consistent with a firm’s own written procedures
- Missing or incomplete documentation
- Corrective actions identified but never made
When policy and practice fall out of step, the effect shows up across the other five findings too. If a firm isn’t doing what its own policy requires, things get missed, standards slip, and accountability breaks down. Fixing that first problem makes the rest easier to solve.
This isn’t only a supervision issue. The alert specifically calls out marketing procedures still built around rules the SEC Marketing Rule replaced in 2022.
Why Policy and Practice Drift Apart
The alert doesn’t describe firms with bad policies or a lack of will. It describes firms whose practice moved on from their policies before they could be updated, a common scenario in an industry where technological and regulatory developments influence behavior at breakneck pace. An annual review only confirms alignment on the day it happens. A firm can be fully aligned in January and drift by March, with nobody finding out until the next review, or an exam.
How Red Oak Closes the Gap
Mira builds supervision policies from the firm’s own handbook, cross-referenced against SEC and FINRA precedent, so the policy it enforces is the firm’s actual policy, not a generic standard. Because it runs continuously, it doesn’t wait for an annual review to notice when practice has moved away from policy. It catches that deviation as it happens, so the firm can act on it straight away: correcting the behavior, updating the policy, or both, rather than letting the gap sit until the next review finds it.
That’s the shift from an annual snapshot to an ongoing state, alignment maintained continuously rather than reconstructed once a year under pressure. The firms this alert describes discovered they’d drifted. With Mira, firms already know, and have time to act.
The same alert also flagged marketing procedures still built around rules the 2022 Marketing Rule replaced, a reminder that this kind of drift isn’t limited to supervision. Red Oak’s Advertising Review holds marketing content to current compliance standards at the point of review, so what gets published reflects where the rules stand today, not where they stood when the policy was last written.
