AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor chief compliance officers at SEC-registered investment advisers who keep the compliance manual, code of ethics and annual review file ready for an exam request.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Every investment adviser registered or required to be registered with the SEC under section 203 of the Advisers Act must meet the rule before giving advice to clients.
SEC Division of Examinations staff, who request the compliance policies, annual review records and code of ethics materials during adviser examinations
Adviser reviews its policies and procedures at least annually; SEC examinations are selected on a risk basis, with priority on newly registered and never-examined advisers
17 CFR 275.206(4)-7, as amended November 19, 2024 (89 FR 91252), 2024-11-19. Free to read.
| Date | What happens | Status |
|---|---|---|
| 2025-11-17 | SEC Division of Examinations publishes fiscal year 2026 priorities, including the effectiveness of advisers' compliance programs | Done |
| 2025-12-03 | Amended Regulation S-P compliance date for larger entities: written incident response and customer notification procedures | Done |
| 2026-06-03 | Amended Regulation S-P compliance date for smaller entities | Done |
| 2026-09-14 | SEC staff risk alert on investment adviser annual compliance reviews | Done |
Each one needs an owner, an approval, and proof it reached the people it covers.
17 CFR 275.206(4)-7(a)
Written policies and procedures, adopted and implemented, reasonably designed to prevent violations of the Advisers Act by the adviser and its supervised persons.
17 CFR 275.206(4)-7(b); 275.204-2(a)(17)(ii)
At least annually the adviser reviews the adequacy of its policies and the effectiveness of their implementation, and keeps any records documenting that review.
17 CFR 275.206(4)-7(c)
The adviser designates a supervised person as chief compliance officer, responsible for administering the policies and procedures it adopts.
17 CFR 275.204A-1(a)
A written code setting standards of business conduct that reflect fiduciary duties, requiring securities law compliance, personal trading reports and prompt reporting of violations to the CCO.
17 CFR 275.204A-1(a)(5); 275.204-2(a)(12)(iii)
Each supervised person receives the code and every amendment and gives the adviser a written acknowledgment of receipt, which the adviser keeps on record.
17 CFR 248.30(a) (Regulation S-P)
Written policies and procedures for administrative, technical and physical safeguards of customer information, including a program to detect, respond to and recover from unauthorized access.
Citations are to the standard or regulation; wording is ours.
What reviewers sample about these documents and the people they cover.
The staff's typical initial request list asks for the compliance policies and procedures in effect during the examination period, compliance consultant reports, and the record of compliance exceptions.
Staff request annual and interim reviews and any reports prepared. The September 2026 risk alert cites gaps between review years, reviews of superseded policy versions, and testing workpapers missing from the books and records.
The request list includes the code of ethics and insider trading policies, code of ethics attestations, exemptions granted to supervised persons, and securities transaction reports from access persons.
Examiners ask for written guidance and training on the compliance program with documentation of attendance. The 2026 risk alert lists, as a deficiency, advisers that treated training or annual attestations as their annual review.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of SEC Rule 206(4)-7? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
The rule text requires the review at least annually; the 2023 amendment adding a written documentation requirement was vacated in 2024 and removed from the CFR on November 19, 2024. Rule 204-2(a)(17)(ii) still requires advisers to keep any records documenting the review, and examiners request any reports prepared.
Rule 204-2(a)(17)(i) requires a copy of the policies and procedures in effect, or in effect at any time within the past five years. The same five-year look-back applies to the code of ethics and to the written acknowledgments under Rule 204-2(a)(12).
The September 2026 risk alert lists this as an observed deficiency. Attestations evidence what personnel received and agreed to, while the review assesses whether the policies are adequate and effectively implemented.
The 2026 risk alert explains that the 18-month window in the 2003 adopting release applied only around the rule's original 2004 effective date. Staff cited first reviews performed 18 months after registration as reviews covering more than 12 months.
The adopting release, quoted in the 2026 risk alert, says advisers should consider interim reviews after significant compliance events, business changes or regulatory developments. The alert adds that advisers must keep any books and records documenting their reviews.
free for 30 days