Project Execution Checklist

Steps an advisory firm or community bank runs to execute an internal project — custodian transition, CRM migration, compliance program rollout, or core banking change — from scoping through CCO sign-off and client notification.

5 sections 24 steps Collects data
1

Project Planning & Scoping

  1. Define scope and regulatory footprint

    • Document what's in scope: account types, custodians, advisor population, AUM affected. Flag any change that touches Form ADV Part 2 (services, fees, custody arrangements), Reg BI disclosures, or books-and-records under Rule 204-2 — those drive separate filing or delivery obligations downstream.

  2. Inventory affected accounts and AUM

    • Pull the affected client list from the CRM (Wealthbox, Redtail, Salesforce FSC) and reconcile against the custodian's account master. Note IRA / qualified accounts separately — RMD-eligible and inherited IRAs often need extra handling on transitions.

    Collects number
  3. Build the project plan with milestones

    • Sequence milestones around custodian cutover windows, ADV annual amendment timing (120 days after fiscal year end), and quarterly billing cycles. Avoid go-live during quarter-end fee billing or RMD season unless unavoidable.

  4. Assign roles across advisory, ops, and compliance

    • Name a single project owner plus leads for advisory, operations, IT, and compliance. CCO sign-off is non-delegable for anything that touches ADV, Reg BI, or supervisory procedures — make that explicit on the RACI.

  5. Establish the project communication cadence

    • Set the steering committee frequency, the advisor update cadence, and the client-facing communication channel. All project communications must run through archived channels — no personal email or unarchived texting per the Reg S-P / off-channel enforcement actions of 2022–2024.

2

Risk & Compliance Assessment

  1. Catalog SEC, FINRA, and state regulatory risks

    • Walk through the full stack: ADV Part 2 disclosure changes, Reg BI / Form CRS impact, custody rule (206(4)-2) implications, advertising rule (206(4)-1), books-and-records (204-2), and AML / CIP / OFAC. State-registered firms add NASAA model rules and state-level filings.

  2. Score likelihood and client impact

    • Rate each risk on a likelihood × impact matrix. Treat anything that could trigger a Form ADV material change, an SAR, or a client restitution event as high-impact regardless of likelihood.

  3. Document mitigation in the risk register

    • For each high or medium risk: name the control, the owner, and the verification method. Attach the register file so the CCO can pull it for the next mock audit or SEC exam request.

    Collects file
  4. Determine whether outside counsel is required

    • Engage outside counsel when the project triggers a novel custody question, a no-action letter dependency, fiduciary determination under PTE 2020-02, or any potential SEC / FINRA disclosure. Cheaper to engage early than to file a corrected ADV.

    Collects list
  5. Engage outside counsel and scope the opinion

    • Send the engagement letter, scope the deliverable (memo vs. opinion letter vs. on-call advice), and set the budget cap. Note any matters where counsel's work product becomes part of the books-and-records file.

  6. Confirm CCO review of the risk register

    • CCO walks the register, signs off on each owner assignment, and flags any item that needs to surface in the next quarterly compliance committee.

3

Quality Assurance & Controls

  1. Define test cases and acceptance criteria

    • For data migrations or system changes, write cases that cover the edge accounts: inherited IRAs, trust accounts with multiple beneficial owners, accounts with SLOAs, accounts with active fee billing schedules. Generic happy-path testing misses the cases that actually break.

  2. Run UAT with operations and advisory leads

    • Operations runs the data and reconciliation cases; advisors run the client-facing cases (statement output, performance reporting, fee invoice). Document any NIGO conditions and route them back to the build team before sign-off.

  3. Reconcile books-and-records impact under Rule 204-2

    • Confirm that records produced after cutover meet the five-year (two-year onsite) retention rule, that historical records remain accessible, and that any new communication channel is captured by the firm's archiving tool (Smarsh, Global Relay, Bloomberg Vault).

  4. Document corrective actions from QA findings

    • Each finding gets a named owner, a remediation due date, and a verification step. Open findings carry into the next steering committee — branch audits get cited for repeat findings cycle after cycle when nobody owns closure.

4

Resource & Vendor Management

  1. Allocate internal staff and budget

    • Map FTE allocation against the project plan. Don't pull CSAs off the new-account pipeline during onboarding crunch — late ACATS reconciliation creates client friction that outlasts any project win.

  2. Run vendor due diligence per Reg S-P

    • For any vendor receiving NPI: SOC 2 Type II review, written information security agreement, breach notification clause, and access controls. Document the due diligence in the vendor file — exam staff will ask.

  3. Confirm staff licensing and CE status

    • Anyone giving advice or executing trades on the project needs current Series 65/66 (IAR) or Series 7/63 (registered rep) registration in the relevant states, plus current FINRA CE / firm element completion. Pull the CRD report for the project team.

  4. Resolve capacity conflicts across the quarter

    • Walk the calendar against quarter-end fee billing, ADV annual amendment, RMD season (Oct–Dec), and any planned audits. Resequence project tasks rather than let two cycles collide.

5

Stakeholder Engagement & Sign-Off

  1. Build the stakeholder map and engagement plan

    • List every stakeholder group: clients, advisors, operations, custodian relationship managers, IT, board / investment committee, regulators if applicable. Note the touch frequency and channel for each.

  2. Hold the weekly steering committee

    • Standing agenda: milestone status, open risk register items, QA findings, vendor blockers, decisions needed from CCO or principals. Minutes filed to the project record.

  3. Determine whether client notification is required

    • Material change to ADV Part 2A, change in custodian, fee structure change, or NPI access change all require client notification. Confirm scope and timing with the CCO before sending — premature or wrong-toned notices generate complaints.

    Collects list
  4. Send the Form ADV / Reg S-P client notice

    • CCO-approved notice goes out via the firm's archived channel (client portal + email). Track delivery and acknowledgment per client; chase non-acknowledgments at day 14 and day 30. File the delivery log in the client folder.

  5. Sign off on project close with the CCO

    • Final close package: closed risk register, QA findings status, client notification delivery log, vendor due diligence file, and any updated supervisory procedures. CCO signs off; project record archived to the books-and-records system.

    Collects list Collects paragraph Collects signature

Use this template

Copy it to your account, customize the steps, and run it with your team in minutes.

Use this workflow Start free trial
Sections 5
Steps 24
Category Financial Services
Price Free to start
Need a different process

Browse hundreds of free templates across every team and industry.

Back to template library

Related templates

More workflows your team can run.

Financial Services

Market Risk Checklist

View
Financial Services

Marketing Strategy Checklist

View
Financial Services

Annual Client Review Checklist

View
Financial Services

Client Onboarding Checklist

View

Run Project Execution Checklist with your team

Customize the steps, assign roles, set a schedule, and keep a complete record for every run.

Use this workflow Start free trial