Well-run firms already have the manual. The work is keeping each version, each annual review and each acknowledgment as ready as the manual itself.
SEC Rules 206(4)-7 and 204A-1
Compliance program and code of ethics Policies reviewed every year, and a code of ethics with each supervised person’s written acknowledgment of receipt, and of every amendment.
The annual review on a schedule, with its record A written acknowledgment for every person and amendment Copies of every version kept FINRA Rule 3110
Written supervisory procedures WSPs maintained and amended, with an annual compliance meeting and each registered person’s attestation of receipt.
Every amendment approved and versioned Each registered person’s attestation on record Meeting materials sent to the people who attend AICPA SQMS No. 1
System of quality management A documented system across every component, communicated to personnel and evaluated each year by the person responsible.
Policies organised by component Communication to personnel on record The annual evaluation on a review date IRS Publication 4557, FTC Safeguards Rule
Written information security plan Tax and advisory practices keep a written plan, review it, and make sure staff have read it. PTIN renewal attests to it.
The plan approved, versioned and reviewed Staff acknowledgment by version The record ready for the annual attestation