SEC-registered investment advisers: what an audit looks like

SEC Division of Examinations

Selection is risk-based. The FY2026 priorities name the effectiveness of advisers' compliance programs, including their annual reviews, and prioritize never-examined and recently registered advisers. Staff request records under section 204(a) of the Advisers Act.

How often. No fixed cycle. The SEC's FY2027 budget justification reports 13% of registered advisers examined in FY2025, 14% in FY2024 and 15% in FY2023, with 9% estimated for FY2026 and 11% for FY2027.

Source ↗

Independent public accountant (custody rule surprise examination)

An adviser with custody of client funds or securities must have an independent public accountant verify them by actual examination under a written agreement, at a time the accountant chooses without prior notice. Advisers whose only custody comes from deducting their advisory fee are excepted.

How often. At least once each calendar year, at a time that is irregular from year to year. The accountant files Form ADV-E within 120 days of the examination.

Source ↗

Compliance policies and procedures

The policies and procedures in effect during the examination period, plus the inventory of compliance risks and conflicts they rest on, with notes on changes to that inventory.

Risk alert of Sept. 6, 2023, attachment, Compliance Program and Oversight Process; Rule 206(4)-7(a); Rule 204-2(a)(17)(i)Source ↗

Annual and interim reviews

Annual and interim reviews of the policies and procedures with any reports prepared, tests performed, compliance consultant reports and the record of compliance exceptions.

Risk alert of Sept. 6, 2023, attachment, Compliance Program and Oversight Process; Rule 206(4)-7(b); Rule 204-2(a)(17)(ii)Source ↗

Code of ethics records

The code of ethics and insider trading policies, attestations, exemptions granted to supervised persons, and access person reports of securities transactions.

Risk alert of Sept. 6, 2023, attachment, Conflicts of Interest and Insider Trading; Rules 204A-1 and 204-2(a)(12) and (a)(13)Source ↗

Compliance training and guidance

Written guidance and training given to employees on the compliance program, with documentation of attendance.

Risk alert of Sept. 6, 2023, attachment, Compliance Program and Oversight ProcessSource ↗

Disclosure documents and client contracts

Form ADV including the brochure, Form CRS, and client advisory contracts. For fee testing the staff also request client account data covering fee computation and payment arrangements.

Risk alert of Sept. 6, 2023, attachment, Disclosures and Filings and Information About Advisory Clients and AccountsSource ↗

Marketing materials

Advertisements and marketing materials in every medium, including websites, blogs and social media, plus testimonials and endorsements with payments made, and third-party ratings.

Risk alert of Sept. 6, 2023, attachment, Marketing and Advertising; Rule 206(4)-1Source ↗

Information security and business continuity

Safeguards for customer records and information, electronic access controls, the business continuity plan, and any cybersecurity incidents with description, impact and remediation.

Risk alert of Sept. 6, 2023, attachment, Information Processing, Reporting, and ProtectionSource ↗

Client accounts and fee calculations

Staff receive client account data and compare how fees were calculated and charged with the advisory agreements and the Form ADV disclosures.

Each year's annual review

Examiners look for gap years, intervals longer than 12 months, and whether the review tested the current version of each policy.

Advertisements and online presence

Staff review marketing across websites, social media and d/b/a sites, and check testimonials and ratings for the required disclosures at the time they were published.

Employee interviews and the office

Staff interview personnel about the business and the compliance program and may tour the office to see the flow of work and the controls.

Annual review late, partial or undocumented

Five observation areas in the staff's September 14, 2026 alert; no percentage published 2026

The staff observed gap years, intervals over 12 months, training or attestations offered in place of a review, reviews that tested superseded policy versions, and review documentation left out of the books and records.

Source ↗

Compliance program not resourced, tailored, current or followed

Five topics drawn from deficiency letters in over 1,000 adviser examinations (2017); Compliance Rule among the most commonly cited (2020) 2017 and 2020

The staff observed CCOs without enough time or authority, off-the-shelf manuals with outdated or unrelated content, and written actions such as employee training and advertising review that were not carried out. It named the Compliance Rule, regulatory filings, custody, code of ethics and books and records as the five most frequent deficiency topics.

Source ↗

Fee billing that departs from agreements and disclosures

A 2018 alert on the most frequent fee and expense issues drew on deficiency letters from over 1,500 adviser examinations; the 2026 alert gives no rate 2018 and 2026

Examiners found fees calculated differently from advisory agreements and Form ADV, unearned fees charged, refunds not issued and economic conflicts left undisclosed. The 2026 alert says findings often led advisers to return money owed to clients.

Source ↗

Marketing rule disclosures and policies

Most common observed reason in the staff's December 16, 2025 alert; no percentage published 2025

The staff named missing disclosures at the time of dissemination as the most common reason a testimonial or endorsement fell short of the rule. It also observed advisers that updated marketing policies without implementing them.

Source ↗

Written policies matched to actual practice

Examiners compare the manual with what the firm does. The staff observed policies that personnel did not follow, typically because they were not aware of the policies or the policies did not fit the business.

Which version was reviewed

Rule 204-2 requires a copy of the policies in effect at any time in the past five years and the records documenting each annual review. The 2026 alert describes reviews that assessed outdated versions that had already been superseded.

Code of ethics receipt and acknowledgment

Each supervised person must receive the code and every amendment and give a written acknowledgment of receipt. The adviser keeps the acknowledgments for each current supervised person and each person from the past five years.

Training and attestation evidence

The initial request asks for written guidance and training with attendance records. The 2020 alert records advisers that did not train employees as their policies required, and the 2026 alert records advisers that treated training or annual attestations as the annual review itself.