Three of the six adviser failures in the SEC's Risk Alert concern how the annual review is run
SEC examiners named six recurring failures in adviser compliance reviews, the first being written policies that differ from actual practice. Red Oak, a compliance software vendor that sells continuous monitoring, argues that annual reviews alone miss that drift.
The Investor · Invest desk
What happened
- Rule 206(4)-7 requires advisers to review their compliance programmes at least annually and to test whether policies fit current business and whether staff follow them.
- The SEC also flagged marketing procedures that still reflected requirements superseded by the Marketing Rule in 2022.
- Red Oak's Mira tool builds supervision policies from a firm's handbook, checks them against SEC and FINRA precedent, and monitors for deviations on an ongoing basis.
Why it matters
- Who's exposed exposure An adviser meeting only the annual minimum can carry a business change unreviewed for up to 364 days, and an examination may be where the gap first surfaces.
- Who has to decide decision A compliance head weighing monitoring software against a tighter annual process faces a list where half the failures concern the review's timing, completeness and method.
- What doesn't add up contradiction The case for continuous monitoring is attributed to a vendor that sells it; the account does not show the SEC recommending it as the remedy.
Sorted by where the failure sits, the six divide in half. Late or missing annual reviews, incomplete review procedures and reviews that skip the firm's own documented process are failures in how the review is run [4][13]. Policies that differ from practice, inadequate record-keeping and corrective actions identified but never implemented are what a review is supposed to catch [3][14]. The split is our classification, not the SEC's.
The rule sets only a floor [1]. A firm that reviews exactly once a year and changes its business the day after sign-off leaves that change unexamined for 364 days [12]. FinTech Global's account makes the same point, describing an annual review as a snapshot that later operational changes can outdate before the next one [7]. The marketing example in the alert shows it concretely: some procedures still reflected requirements that the Marketing Rule superseded in 2022 [6]. The account does not say whether those firms had completed their reviews on time.
The case for monitoring comes from Red Oak, a RegTech provider, which argues that continuous monitoring can help firms find and fix discrepancies before they become regulatory problems [10][8]. Its Mira tool builds supervision policies from a firm's handbook, cross-references SEC and FINRA precedent, and monitors on an ongoing basis [9]. Red Oak sells the product, and the account does not show the SEC recommending continuous monitoring. The account is also the only source here, and it does not give the alert's date, the number of firms examined or how often each failure appeared [11].
We think the angle holds for drift and fails for the rest. Monitoring shortens the window in which a business change or a rule change goes unchecked. It does nothing for a review that is late, thin or off-process, and that is half the list [13]. An adviser that buys monitoring while its annual review runs late has paid for the drift problem and left the review problem as it was.
The counter-case is fair. The account says the policy-practice disconnect can contribute to failures in the other areas [5], and if that is so, closing it early could shrink the review failures too. We would be wrong if the alert shows most findings were drift at firms whose annual reviews were timely and complete.
What to watch
- The text of the Risk Alert itself: whether it gives dates, firm counts or frequencies, and whether policy-practice mismatch was the most common finding.
- Any examination findings showing drift at firms whose annual reviews were on time and complete, which would support the case for monitoring.
- Customer data from Red Oak or rival vendors showing how many deviations were caught between annual reviews.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+20
- Incentives70
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Under Rule 206(4)-7, investment advisers must review their compliance programmes at least annually, assessing whether policies and procedures remain adequate for current business activities and whether employees follow them in practice.
- [2]
The SEC Division of Examinations uses Risk Alerts to highlight recurring weaknesses found by examiners, and the latest alert identified six areas of concern.
- [3]
The first of the six areas listed is policies that do not reflect actual practices.
- [4]
The other five areas are late or missing annual reviews, incomplete review procedures, reviews that do not follow a firm's documented processes, inadequate record-keeping, and corrective actions that are identified but not implemented.
- [5]
FinTech Global's account says the disconnect between written policies and actual practices can contribute to failures across the other areas.
- [6]
The SEC highlighted outdated marketing procedures that continued to reflect requirements superseded by the SEC Marketing Rule in 2022.
- [7]
An annual review is a snapshot of a firm's compliance position at a point in time, and later operational changes can create new gaps before the next assessment.
- [8]
Red Oak argues that continuous monitoring can help firms identify and address discrepancies between written policies and practice before they become regulatory problems.
- [9]
Red Oak's Mira tool builds supervision policies from a firm's own handbook, cross-references them against SEC and FINRA precedent, and monitors compliance on an ongoing basis.
- [10]
Red Oak is a RegTech provider.
- [11]
The FinTech Global account does not state the Risk Alert's date, the number of firms examined, or how often each of the six failures appeared.
- [12]
A firm reviewing only at the annual minimum can leave a change made the day after a review unexamined for up to 364 days.
- [13]
Three of the six failures (late or missing reviews, incomplete review procedures, reviews not following documented processes) concern how the review is run: 3 of 6, or 50%.
- [14]
The other three failures (policies differing from practice, inadequate record-keeping, unimplemented corrective actions) are issues a review is meant to detect or close.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- fintech.globalPolicy drift exposes gaps in SEC compliance reviews
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.