1

November 19, 2020

OCIE Observations: Investment Adviser Compliance Programs

I. Introduction

This Risk Alert provides an overview of notable compliance issues identified by the Office of 

Compliance Inspections and Examinations (“OCIE”)∗ related to Rule 206(4)-7 (the “Compliance 

Rule”) under the Investment Advisers Act of 1940 (“Advisers Act”).

1

 Deficiencies related to the 

Compliance Rule have been among the most common cited by OCIE.2

Under the Compliance Rule, it is unlawful for an investment adviser registered with the 

Commission (“adviser”) to provide investment advice unless the adviser has adopted and 

implemented written policies and procedures reasonably designed to prevent violation of the 

Advisers Act and the rules thereunder by the adviser or any of its supervised persons. The 

Compliance Rule requires advisers to consider their fiduciary and regulatory obligations under 

the Advisers Act and to formalize policies and procedures to address them.3

The Compliance Rule does not enumerate specific elements that advisers must include in their 

policies and procedures. Each adviser should adopt policies and procedures that take into 

consideration the nature of that firm's operations. The policies and procedures should be 

designed to prevent violations from occurring, detect violations that have occurred, and correct 

promptly any violations that have occurred.

The Compliance Rule also requires each adviser to review its policies and procedures no less 

frequently than annually to determine their adequacy and the effectiveness of their 

implementation. The review should consider any compliance matters that arose during the 

previous year, any changes in the business activities of the adviser or its affiliates, and any 

 ∗ The views expressed herein are those of the staff of OCIE. This Risk Alert is not a rule, regulation, or statement 

of the Securities and Exchange Commission (the “SEC” or the “Commission”). The Commission has neither 

approved nor disapproved the content of this Risk Alert. This Risk Alert has no legal force or effect: it does not 

alter or amend applicable law, and it creates no new or additional obligations for any person. This document 

was prepared by OCIE staff and is not legal advice. 

1 This Risk Alert reflects issues identified in a sample of deficiency letters from recent adviser exams. This Risk 

Alert does not discuss all types of deficiencies or weaknesses related to the Compliance Rule that have been 

identified by staff.

2 See OCIE Risk Alert, The Five Most Frequent Compliance Topics Identified in OCIE Examinations of 

Investment Advisers (Feb. 7, 2017); OCIE Risk Alert, Observations from Examinations of Investment 

Advisers: Compliance, Supervision, and Disclosure of Conflicts of Interest (July 23, 2019); OCIE Risk Alert, 

Observations from Investment Adviser Examinations Relating to Electronic Messaging (Dec. 14, 2018).

3 Release No. IA-2204, Compliance Programs of Investment Companies and Investment Advisers (Dec 17, 

2003).
2

changes in the Advisers Act or applicable regulations that might suggest a need to revise the 

policies or procedures. Although the Compliance Rule requires only annual reviews, advisers 

should consider the need for interim reviews in response to significant compliance events, 

changes in business arrangements, and regulatory developments.4

Finally, the Compliance Rule requires each adviser to designate a chief compliance officer

(“CCO”) to administer its compliance policies and procedures. An adviser's CCO should be 

competent and knowledgeable regarding the Advisers Act and should be empowered with full 

responsibility and authority to develop and enforce appropriate policies and procedures for the 

firm. The CCO should have a position of sufficient seniority and authority within the 

organization to compel others to adhere to the compliance policies and procedures.5

II. Compliance Rule Deficiencies and Weaknesses Identified by OCIE

Below are examples of notable deficiencies or weaknesses identified by OCIE staff in 

connection with the Compliance Rule:

A. Inadequate Compliance Resources. OCIE staff observed advisers that did not devote 

adequate resources, such as information technology, staff and training, to their 

compliance programs. For example:

• CCOs who had numerous other professional responsibilities, either elsewhere with 

the adviser or with outside firms, and who did not appear to devote sufficient time to 

fulfilling their responsibilities as CCO. While CCOs may have multiple 

responsibilities, OCIE observed instances where such CCOs did not appear to have 

time to develop their knowledge of the Advisers Act or fulfill their responsibilities as 

CCO.

• Compliance staff that did not have sufficient resources to implement an effective 

compliance program. OCIE staff observed advisers that did not appear to devote 

sufficient resources, such as a lack of adequate training or insufficient staff, to their 

compliance functions. This affected the implementation of the compliance policies 

and procedures the adviser had adopted and compliance with fundamental regulatory 

requirements, such as performing annual reviews, accurately completing and filing 

Form ADVs or timely responding to OCIE requests for required books and records.

• Advisers that had significantly grown in size or complexity, but had not hired 

additional compliance staff or added adequate information technology, leading to 

failures in implementing or tailoring their compliance policies and procedures.

 4 See Id.

5 See Id.
3

B. Insufficient Authority of CCOs. OCIE staff observed CCOs who lacked sufficient 

authority within the adviser to develop and enforce appropriate policies and procedures 

for the adviser. For example:

• Advisers that restricted their CCOs from accessing critical compliance information,

such as trading exception reports and investment advisory agreements with key

clients.

• Advisers where senior management appeared to have limited interaction with their 

CCOs, which led to CCOs having limited knowledge about the firm’s leadership, 

strategy, transactions, and business operations. 

• Instances where CCOs were not consulted by senior management and employees of 

the adviser regarding matters that had potential compliance implications.

C. Annual Review Deficiencies. OCIE staff observed advisers that were unable to 

demonstrate that they performed an annual review or whose annual reviews failed to 

identify significant existing compliance or regulatory problems. For example:

• Evidence of annual review. Advisers that claimed to engage in ongoing or annual 

compliance reviews of their policies and procedures to determine their adequacy and 

effectiveness of their implementation, but could not provide evidence that one 

occurred.

• Identification of risks. Advisers that claimed to have performed limited annual 

reviews but failed to identify or review key risk areas applicable to the adviser, such 

as conflicts and protection of client assets.

• Review of significant aspects of adviser’s business. Advisers that failed to review 

significant areas of their business, such as policies and procedures surrounding the 

oversight and review of recommended third-party managers, cybersecurity, and the 

calculation of fees and allocation of expenses.

D. Implementing Actions Required by Written Policies and Procedures. OCIE staff 

observed advisers that did not implement or perform actions required by their written 

policies and procedures. For example, staff observed advisers that did not:

• Train their employees.

• Implement compliance procedures regarding trade errors, advertising, best 

execution, conflicts, disclosure and other requirements.

• Review advertising materials.

• Follow compliance checklists and other processes, including backtesting fee 

calculations and testing business continuity plans. 

• Review client accounts, e.g., to assess consistency of portfolios with clients’ 

investment objectives, on a periodic basis or on a schedule required in the adviser’s 

policies.
4

E. Maintaining Accurate and Complete Information in Policies and Procedures. The staff 

observed advisers’ policies and procedures that contained outdated or inaccurate 

information about the adviser, including off-the-shelf policies that contained unrelated or 

incomplete information.

F. Maintaining or Establishing Reasonably Designed Written Policies and Procedures. 

OCIE staff observed advisers that did not maintain written policies and procedures or that 

failed to establish, implement, or appropriately tailor written policies and procedures that 

were reasonably designed to prevent violations of the Advisers Act. For example, staff 

observed advisers that claimed to rely on cursory or informal processes instead of 

maintaining written policies and procedures. In addition, staff observed advisers that 

utilized policies of an affiliated entity, such as a broker-dealer, that were not tailored to 

the business of the advisers. 

Where firms maintained written policies and procedures, OCIE staff observed 

deficiencies or weaknesses with establishing, implementing or appropriately tailoring 

their written policies and procedures in the following areas:

6

• Portfolio management.

o Due diligence and oversight of outside managers. 

o Monitoring compliance with client investment and tax planning strategies. 

o Oversight of third-party service providers. 

o Due diligence and oversight of investments, including alternative assets.

o Oversight of branch offices and investment advisory representatives to ensure 

they are complying with the adviser’s policies and procedures.

o Compliance with regulatory and client investment restrictions.

o Adherence with investment advisory agreements.

• Marketing.

7

o Oversight of solicitation arrangements.

o Prevention of the use of misleading marketing presentations, including on

websites.

 6 Id. (“We expect that an adviser's policies and procedures, at a minimum, should address the following issues to 

the extent that they are relevant to that adviser: Portfolio management processes, including allocation of 

investment opportunities among clients and consistency of portfolios with clients' investment objectives, 

disclosures by the adviser, and applicable regulatory restrictions; Trading practices, including procedures by 

which the adviser satisfies its best execution obligation, uses client brokerage to obtain research and other 

services (“soft dollar arrangements”), and allocates aggregated trades among clients; The accuracy of 

disclosures made to investors, clients, and regulators, including account statements and advertisements;

Safeguarding of client assets from conversion or inappropriate use by advisory personnel; The accurate creation 

of required records and their maintenance in a manner that secures them from unauthorized alteration or use and 

protects them from untimely destruction; Marketing advisory services, including the use of solicitors; Processes 

to value client holdings and assess fees based on those valuations; Safeguards for the privacy, protection of

client records and information; Business continuity plans.”)

7 See The Most Frequent Advertising Rule Compliance Issues Identified in OCIE Examinations of Investment 

Advisers (Sep. 14, 2017).
5

o Oversight of the use and accuracy of performance advertising.

• Trading practices.

o Allocation of soft dollars.

o Best execution.8

o Trade errors.

o Restricted Securities.

• Disclosures.

o Accuracy of Form ADV.

o Accuracy of client communications.

• Advisory fees and valuation. 

o Fee billing processes, including how fees are calculated, tested, or monitored for 

accuracy.

o Expense reimbursement policies and procedures.

o Valuation of advisory client assets.

• Safeguards for client privacy.

o Regulation S-P.9

o Regulation S-ID.

o Physical security of client information.

o Electronic security of client information, including encryption policies.

o General cybersecurity, including access rights and controls, data loss prevention, 

penetration testing and/or vulnerability scans, vendor management, employee 

training or incident response plans.

• Required books and records. Written policies and procedures to make and keep 

accurate books and records as required under Rule 204-2 under the Advisers Act.

• Safeguarding of client assets. Written policies and procedures regarding custody and 

safety of client assets.

• Business continuity plans. The maintenance of adequate disaster recovery plans 

because the business continuity plans were not tested or did not contain contact 

information or designate responsibility for business continuity plan actions.10

 8 See OCIE Risk Alert, Compliance Issues Related to Best Execution by Investment Advisers (July 11, 2018).

9 See OCIE Risk Alert, Investment Adviser and Broker-Dealer Compliance Issues Related to Regulation S-P –

Privacy Notices and Safeguard Policies (April 16, 2019).

10 See OCIE Risk Alert, SEC Examinations of Business Continuity Plans of Certain Advisers Following 

Operational Disruptions Caused by Weather-Related Events Last Year (August 27, 2013).
6

III. Conclusion

In response to these observations, many of the advisers modified their written policies and 

procedures to address the issues identified by OCIE staff. OCIE encourages advisers to review 

their written policies and procedures, including implementation of those policies and procedures, 

to ensure that they are tailored to the advisers’ business and adequately reviewed and 

implemented.

This Risk Alert is intended to highlight for firms risks and issues that OCIE staff has identified. In 

addition, this Risk Alert describes risks that firms may consider to (i) assess their supervisory, compliance, 

and/or other risk management systems related to these risks, and (ii) make any changes, as may be 

appropriate, to address or strengthen such systems. Other risks besides those described in this Risk Alert 

may be appropriate to consider, and some issues discussed in this Risk Alert may not be relevant to a 

particular firm’s business. The adequacy of supervisory, compliance and other risk management systems 

can be determined only with reference to the profile of each specific firm and other facts and 

circumstances.