Annual Compliance Program Review

Walk each business line — advisory, custody arrangements, marketing, trading, vendor management — and identify inherent risks against Advisers Act Rule 206(4)-7. Reuse last year's matrix as a starting point but refresh: new services, new custodians (Schwab/Fidelity/Altruist), new staff, new SEC risk alerts. The CCO owns this.

Score each risk on inherent severity and likelihood, then on residual after existing controls. Off-channel comms and custody (SLOA, fee debits) typically rank highest for small RIAs based on recent SEC enforcement patterns.

Walk the manual section-by-section against the latest Advisers Act rules, Marketing Rule (206(4)-1), Custody Rule (206(4)-2), Reg S-P, and any new SEC risk alerts from the last 12 months. ComplySci, ACA, or RIA in a Box redlines are a useful starting point if you subscribe.

Compare current ADV Part 2A against firm reality: fee schedule changes, new services, new conflicts, disciplinary disclosures, ownership changes, AUM band shifts. Material changes require a summary in Item 2 and amendment filing.

Annual updating amendment is due within 90 days of fiscal year end; material change interim amendments are due promptly. File via IARD and deliver the updated brochure to all existing clients within 120 days of FYE — track delivery acknowledgments per client in the CRM.

Confirm access-person definitions still cover the right staff, restricted/watch lists are current, and pre-clearance and reporting workflows are working. Collect annual holdings reports within 45 days of year-end and quarterly transaction reports within 30 days of quarter-end per Rule 204A-1.

Cover the firm's code of ethics, off-channel communications policy, Marketing Rule basics, custody/SLOA safeguards, Reg S-P privacy, and current-year SEC risk alerts. Use case-study scenarios over generic slides — staff retention is materially better when training is firm-specific.

NASAA IAR CE: 12 credits annually (6 ethics, 6 products and practice). FINRA Regulatory Element CE annually for registered reps. Pull rosters by license type and chase any rep at risk of failing — late completion is a state and FINRA late-fee event.

Pull a sample of website pages, LinkedIn posts, pitch decks, and one-pagers from the last 12 months. Verify each: testimonials/endorsements have required disclosures, performance presentations meet net-of-fees and time-period requirements, hypothetical performance is restricted to intended audiences. Document the review in the advertising log.

Pull the user list from Smarsh / Global Relay / Bloomberg Vault and reconcile against HR's active employee list. Confirm MyRepChat or equivalent is provisioned for any rep who texts clients. The 2022-2024 SEC off-channel sweep produced over $2B in fines — gaps here are not theoretical.

Pull every active SLOA on file and verify each meets the seven IM no-action letter conditions: written client authorization, third-party only, custodian confirmation to client, etc. Reconcile against the firm's surprise exam scope. SLOA gaps are the most common path to inadvertent custody.

Sample trades for: best execution review, allocation fairness across blocks, fee billing accuracy (three-way: invoice / custodian debit / internal calculation), and rebalance drift. Document the sample size and results. Errors found get logged to the error account with a five-day resolution SLA.

Each finding gets an owner, severity rating, remediation plan, and target close date. Recurring findings across multiple annual reviews are an SEC red flag — note any item that appears for the second consecutive year.

Material findings get same-week escalation to the managing principal and, where applicable, the firm's board or advisory committee. Document the escalation memo, the response, and the agreed remediation owner. The escalation memo itself becomes part of the annual review file.