1

By the Office of Compliance Inspections and Examinations (“OCIE”)1

Volume V, Issue 1 November 9, 2015

Examinations of Advisers and Funds 

That Outsource Their Chief Compliance Officers

OCIE staff (the “staff”) have noted a growing trend in the investment 

management industry: outsourcing compliance activities to third parties, 

such as consultants or law firms.2

 Some investment advisers and funds 

have outsourced all compliance activities to unaffiliated third parties, 

including the role of their chief compliance officers (“CCOs”).3 

Outsourced CCOs may perform key compliance responsibilities, such as 

updating firm policies and procedures, preparing regulatory filings, and 

conducting annual compliance reviews.

The staff conducted nearly 20 examinations as part of an Outsourced 

CCO Initiative that focused on SEC-registered investment advisers and 

investment companies (collectively, “registrants”) that outsource their

CCOs to unaffiliated third parties (“outsourced CCOs”). The purpose of 

this Risk Alert is to share the staff’s observations from these 

examinations and raise awareness of the compliance issues observed by 

the staff.

 1 The views expressed herein are those of the staff of OCIE, in coordination with other staff of the Securities and Exchange 

Commission (“SEC” or “Commission”), including staff of the Division of Investment Management and the Division of Enforcement. 

The Commission has expressed no view on the contents of this Risk Alert. This document was prepared by SEC staff and is not legal 

advice.

2 See Charles Schwab & Corp., Independent Advisors’ Revenue and Assets Rebound for Record Year, Says 2011 Charles Schwab RIA 

Benchmarking Study (July 5, 2011). The study recorded that 38% of firms are outsourcing some aspect of their compliance function, which 

was up over ten percent from 27% the previous year. This survey covered 820 RIAs with more than $300 billion in combined assets, with 

the median study participant having ended 2010 with $212 million in assets under management. In a Charles Schwab Market Knowledge 

Tools synopsis regarding the 2012 Benchmarking Study, Charles Schwab stated that “[i]ncreased reliance on outside experts for compliance 

has been a strong trend...not only reducing expense but potentially lowering the risks of overlooking or misinterpreting evolving 

requirements.” (See, Charles Schwab & Corp., “Moving Forward in Uncertain Times: Insights From the 2012 RIA Benchmarking Study 

from Charles Schwab.”) By contrast, see Investment Adviser Association (“IAA”), Summary Report for the 2013 Investment Management 

Compliance Testing Survey (June 11, 2013). The survey reported that 99% of the firms surveyed did not outsource the role of the CCO. 

More than 92% of the participants in the 2013 IAA survey managed in excess of $500 million in assets, and the average firm managed 

between $1 billion and $20 billion. 

3 Articles have been written and speeches delivered on the trend of outsourcing the role of the CCO. See, e.g., Rachel Louise Ensign, 

“Companies Are Outsourcing the Chief Compliance Officer Job,” WALL STREET JOURNAL (July 17, 2014); Nick Georgis, “The 

Outsourcing Boom: Compliance,” THINK ADVISOR (December 27, 2011); and Bettiny Eckerle, “Trend to Watch for 2012: Outsourcing 

Investment Adviser Compliance,” Eckerle Law (January 11, 2012). 

In this Alert: 

Topic: Staff observations 

regarding examinations of 

investment advisers and 

investment companies that 

outsource their chief compliance 

officer (“CCO”).

Key Takeaways: Advisers and 

funds with outsourced CCOs 

should review their business 

practices in light of the risks 

noted in this Risk Alert to 

determine whether these 

practices comport with their 

responsibilities as set forth in the 

Compliance Rules. Advisers with 

outsourced CCOs retain the 

responsibility for adopting and 

implementing an effective 

compliance program.
2

I. The Compliance Rules

Rule 206(4)-7 under the Investment Advisers Act of 1940 (“Advisers Act”) and Rule 38a-1 under the 

Investment Company Act of 1940 (“Investment Company Act”), often referred to as the “Compliance 

Rules,”4 require registrants to:

• Adopt and implement written policies and procedures that are reasonably designed to prevent 

violations by the adviser and its supervised persons of the Advisers Act and its rules and 

violations by the fund of the federal securities laws and the rules under those laws, respectively;

5

• Designate an individual as CCO to be responsible for administering the policies and procedures;

6

and

• Review the policies and procedures at least annually for their adequacy and the effectiveness of 

their implementation.

7

 Fund CCOs must also prepare a written report for the fund’s board of 

directors.8

The Commission has provided guidance regarding the quality, experience, and empowerment of the 

CCOs to advisers. For example, the Commission has stated that an adviser’s CCO should be 

“competent and knowledgeable regarding the Advisers Act and . . . empowered with full responsibility 

and authority to develop and enforce appropriate policies and procedures for the firm [and] have a 

position of sufficient seniority and authority within the organization to compel others to adhere to the 

compliance policies and procedures.”9

 Similarly, the Commission stated that a fund’s CCO should be 

“competent and knowledgeable regarding the federal securities laws and should be empowered with full 

responsibility and authority to develop and enforce appropriate policies and procedures for the fund.”10 

Moreover, the Commission highlighted that fund and adviser CCOs “should have sufficient seniority 

and authority to compel others to adhere to the compliance policies and procedures.”11

 4 See also SEC, Compliance Programs of Investment Companies and Investment Advisers, Release Nos. IA-2204 and IC-26299 (December 

17, 2003) (“Adopting Release”). In the Adopting Release, the Commission stated that it is of critical importance that registrants have 

“strong systems of controls in place to prevent violations of the federal securities laws and to protect the interests of shareholders and 

clients.”

5 Rule 206(4)-7(a) under the Advisers Act and Rule 38a-1(a)(1) under the Investment Company Act. The Compliance Rule under the 

Advisers Act applies to advisers and their “supervised persons.” The term “supervised persons” is defined as “any partner, officer, director 

(or other person occupying a similar status or performing similar functions), or employee of an investment adviser, or other person who 

provides investment advice on behalf of the investment adviser and is subject to the supervision and control of the investment adviser.” 

Section 202(a)(25) of the Advisers Act.

As noted in the Adopting Release, in designing its policies and procedures, each registrant should identify conflicts, and other compliance 

factors that create a risk exposure for the firm and clients in light of the firm’s particular operations and design policies and procedures to 

address these risks. An adviser should also consider its fiduciary obligations.

6 Rule 206(4)-7(c) under the Advisers Act (requiring that the CCO be a supervised person) and Rule 38a-1(a)(4) under the Investment 

Company Act.

7 Rule 206(4)-7(b) under the Advisers Act and Rule 38a-1(a)(3) under the Investment Company Act.

8 Rule 38a-1(a)(4)(iii) under the Investment Company Act.

9 Adopting Release, Section II.C.1. 

10 Adopting Release, Section II.C.2.

11 Adopting Release, Sections II.C.1 and II.C.2.
3

II. Staff Examinations

CCOs are integral participants in OCIE’s examinations of registrants. For example, each examination 

typically includes interviews with the CCO and other senior officers. During these interviews, the staff 

assesses the registrants’ tone at the top and culture of compliance.12 These assessments are important 

factors in the staff’s review of the effectiveness of the registrants’ compliance programs in which a CCO 

plays an important role. 

As part of the Outsourced CCO Initiative, the staff evaluated the effectiveness of registrants’ compliance 

programs and outsourced CCOs by considering, among other things, whether:

• The CCO was administering a compliance environment that addressed and supported the goals 

of the Advisers Act, Investment Company Act, and other federal securities laws, as applicable

(i.e., compliance risks were appropriately identified, mitigated, and managed);

• The compliance program was reasonably designed to prevent, detect, and address violations of 

the Advisers Act, Investment Company Act, and other federal securities laws, as applicable;

• The compliance program supported open communication between service providers and those 

with compliance oversight responsibilities;

• The compliance program appeared to be proactive rather than reactive;

• The CCO appeared to have sufficient authority to influence adherence with the registrant’s 

compliance policies and procedures, as adopted, and was allocated sufficient resources to 

perform his or her responsibilities; and

• Compliance appeared to be an important part of the registrant’s culture.

III. Staff Observations

During these examinations, the staff observed instances where the outsourced CCO was generally 

effective in administering the registrant’s compliance program, as well as fulfilling his/her other 

responsibilities as CCO. The staff observations regarding effective outsourced CCOs generally

involved: regular, often in-person, communication between the CCOs and the registrants; strong 

relationships established between the CCOs and the registrants; sufficient registrant support of the 

CCOs; sufficient CCO access to registrants’ documents and information; and CCO knowledge about the 

regulatory requirements and the registrants’ business. More specifically, the staff observed the 

following:

• Communications: Outsourced CCOs who frequently and personally interacted with advisory

and fund employees (in contrast with impersonal interaction, such as electronic communication

 12 The staff’s assessment of the registrant’s tone at the top and culture, however, is not based solely on interviews with the CCO and other 

senior officers, but can be informed by other factors.
4

or pre-defined checklists) appeared to have a better understanding of the registrants’ businesses, 

operations, and risks. As a result, at these registrants the staff noted fewer inconsistencies 

between the compliance policies and procedures and the registrants’ actual business practices. 

The staff also noted that these CCOs were typically able to effectuate compliance changes that 

they deemed to be necessary.

• Resources: More significant compliance-related issues were identified at registrants with an 

outsourced CCO that served as the CCO for numerous unaffiliated firms and that did not appear 

to have sufficient resources to perform compliance duties, especially given the disparate and 

dispersed nature of the registrants that the CCO serviced.

• Empowerment: Annual reviews performed by outsourced CCOs, who were able to 

independently obtain the records they deemed necessary for conducting such reviews, more 

accurately reflected the registrants’ actual practices than annual reviews conducted by CCOs, 

who relied wholly on the firm to select the records subject to their review. In some instances, the

registrants’ employees had discretion to determine which documents were provided to the 

outsourced CCOs. In these cases, the registrants’ ability to selectively provide records to the 

outsourced CCO may have affected the accuracy of these registrants’ annual reviews. 

The staff’s observations with respect to the strength and effectiveness of the registrants’ compliance 

programs are described in further detail below.

A. Meaningful Risk Assessments 

The staff observed that an effective compliance program generally relies upon, among other things, the 

correct identification of a registrant’s risks in light of its business, operations, conflicts, and other 

compliance factors. The compliance policies and procedures should then be designed to address those 

risks. The staff observed that certain outsourced CCOs could not articulate the business or compliance 

risks of the registrant or, to the extent the risks were identified, whether the registrant had adopted 

written policies and procedures to mitigate or address those risks. In some instances, the risks described 

to the staff by the registrant’s principals were different than the risks described by the outsourced CCO. 

In these instances, the staff identified several areas where the registrant did not appear to have policies, 

procedures, and/or disclosures in place necessary to address certain risks. 

• Standardized checklists: The staff notes that some outsourced CCOs used standardized 

checklists to gather pertinent information regarding the registrants. While the use of 

questionnaires or standardized checklists may be a helpful guide to identify conflicts and assess 

risks at registrants, the staff observed the following:

o Some standardized risk checklists utilized by outsourced CCOs were generic and did not

appear to fully capture the business models, practices, strategies, and compliance risks that 

were applicable to the registrant. 

o Some of the responses to the standardized questionnaires completed by the registrants 

included incorrect or inconsistent information about the firms’ business practices. The 
5

outsourced CCOs did not appear sufficiently knowledgeable about the registrant to identify 

or follow-up with the registrant to resolve such discrepancies.

13

• Policies, procedures, and disclosures: Several registrants did not appear to have the policies, 

procedures, or disclosures in place necessary to address all of the conflicts of interest identified by 

the staff. These issues were identified in critical areas that affect the registrants’ clients, such as 

compensation practices, portfolio valuation, brokerage and execution, and personal securities 

transactions by access persons.

B. Compliance Policies and Procedures

Although the Compliance Rules

14 do not expressly require compliance policies and procedures to 

contain specific elements, the Commission stated in the Adopting Release that it expects an adviser’s 

policies and procedures, at a minimum, to address ten core areas to the extent that they are relevant to 

the adviser’s business.15 The staff observed certain instances where the registrants did not appear to 

have adopted, implemented, and/or adhered to policies and procedures that were reasonably designed to 

prevent the violation of applicable regulations or that were relevant in light of the registrant’s business 

and operations, such as the following:

• Compliance policies and procedures were not followed: The staff observed instances in 

which compliance policies and procedures were not followed or the registrants’ actual practices 

were not consistent with the description in the registrants’ compliance manuals. These practices 

were observed in areas that are required to be reviewed by regulations (e.g., reviews required for 

the payment of cash for solicitation activities and personal securities transactions) and in areas 

that registrants included in their policies and procedures, but that are not expressly required to be 

reviewed by regulations (e.g., quarterly review of employees’ e-mails).

16 In many instances, the 

outsourced CCOs were designated as the individuals responsible for conducting the reviews.

 13 Similarly, in a recent enforcement action, the Commission’s Division of Enforcement alleged that the conduct of an adviser’s outsourced 

CCO contributed to the firm making false filings with the Commission because the outsourced CCO “did not personally review [the 

adviser’s] records” to validate the information. Instead, he relied “exclusively on information provided to him by [advisory personnel].” 

See In re Aegis Capital LLC, Advisers Act Rel. No 4054 (March 30, 2015).

14 See Section I herein for definition of Compliance Rules.

15 Adopting Release. The ten core areas are: portfolio management processes; accuracy of disclosures made to investors, clients, and 

regulators; proprietary trading; safeguarding of client assets from conversion or inappropriate use by advisory personnel; accurate creation 

and retention of required records; safeguards for the privacy protection of client records and information; trading practices; marketing 

advisory services; processes to value client holdings and assess fees based on those valuations; and business continuity plans.

16 Rule 206(4)-3(a)(2)(iii)(C) under the Advisers Act requires an adviser that pays a cash fee to a solicitor for solicitation activities to make a 

“bona fide effort to ascertain whether the solicitor has complied with the agreement, and has a reasonable basis for believing that the 

solicitor has so complied.” Rule 204A-1(a)(3) under the Advisers Act requires an adviser registrant to establish, maintain and enforce a 

written code of ethics that includes “[p]rovisions that require all of [registrant’s] access persons to report, and [registrant] to review, their 

personal securities transactions and holdings periodically.” Also, Investment Company Act Rule 17j-1(c)(2)(ii)(A) generally requires a fund 

and its adviser, among others, to, no less frequently than annually, furnish to the fund's board of directors a written report that describes, 

among other things, any issues arising under the fund’s code of ethics or procedures since the last report to the board of directors, including, 

but not limited to, information about material violations of the code or procedures and sanctions imposed in response to the material 

violations. The staff has observed that the CCO typically participates in the preparation of such reports.
6

• Compliance policies and procedures were not tailored to registrants’ businesses or 

practices: Several of the compliance manuals that the staff reviewed were created using 

outsourced CCO-provided templates. However, some of these templates were not tailored to 

registrants’ businesses and practices and, thus, the compliance manuals that had been adopted 

contained policies and procedures that were not appropriate or applicable to the registrants’ 

businesses or practices.

17 Examples include:

o Critical areas were not identified, and thus certain compliance policies and procedures were 

not adopted, such as reviewing third-party managers hired to manage client money, or 

safeguarding client information. 

o Policies were adopted, but were not applicable to the advisers’ businesses and operations, 

such as: monitoring of account performance composites when in practice the adviser did not 

monitor composites because it did not advertise performance; collecting management fees 

quarterly in advance when in practice clients were billed monthly in arrears; and referencing 

departed employees as responsible parties in performing compliance reviews or monitoring.

o Critical control procedures were not performed, or not performed as described, including: 

oversight of private fund fee and expense allocations; reviews of solicitation activities for 

compliance with the Advisers Act; trade allocation reviews for fairness of side-by-side 

management of client accounts with proprietary accounts; oversight of performance 

advertising and marketing; personal trading reviews of all access persons; and controls over 

trade reconciliations. 

C. Annual Review of the Compliance Programs

For the registrants examined, the outsourced CCOs were typically responsible for conducting and 

documenting registrants’ annual reviews, which included testing for compliance with existing policies 

and procedures. The staff, however, observed a general lack of documentation evidencing the testing.

18

In addition, the staff notes that certain outsourced CCOs infrequently visited registrants’ offices and 

conducted only limited reviews of documents or training on compliance-related matters while on-site. 

Such CCOs had limited visibility and prominence within the registrants’ organization, which appeared 

to result in the CCOs also having limited authority within the organization to, among other things,

improve adherence to the registrants’ compliance policies and procedures. Limited authority also 

appeared to affect the outsourced CCOs’ ability to implement important changes in disclosure regarding 

key areas of client interest, such as advisory fees.

 17 In the Adopting Release, the Commission noted that investment advisers are too varied in their operations for the rule to impose a “single 

set of universally applicable required elements” and that instead “[e]ach adviser should adopt policies and procedures that take into 

consideration the nature of that firm’s operations.” In describing how advisers should actually design their policies and procedures, the 

Commission suggested that each firm “should first identify conflicts and other compliance factors creating risk exposure for the firm and its 

clients in light of the firm’s particular operations, and then design policies and procedures that address those risks.”

18 The staff notes that, while registrants must review their policies and procedures at least annually for their adequacy and the effectiveness of 

their implementation, there are no specific requirements under the Compliance Rules regarding documentation. The staff notes, however, 

that there is a parallel recordkeeping requirement under Rule 204-2(a)(17)(ii) under the Advisers Act, which requires advisers to retain “any 

records” documenting the annual review conducted pursuant to the Compliance Rule. 
7

IV. Conclusion

During these examinations, the staff observed certain compliance weaknesses associated with registrants 

that outsourced their CCOs, as described in this Risk Alert. Advisers and funds with outsourced CCOs 

should review their business practices in light of the risks noted in this Risk Alert to determine whether 

these practices comport with their responsibilities as set forth in the Compliance Rules. The staff 

anticipates that, by sharing these examination observations, it will assist registrants in assessing whether 

their compliance programs have weaknesses, particularly with respect to identifying applicable risks and 

ensuring that the firm’s compliance program encompasses all relevant business activities. 

A CCO, either as a direct employee of a registrant or as a contractor or consultant, must be empowered 

with sufficient knowledge and authority to be effective. Each registrant is ultimately responsible for 

adopting and implementing an effective compliance program and is accountable for its own deficiencies. 

Registrants, particularly those that use outsourced CCOs, may want to consider the issues identified in 

this Risk Alert to evaluate whether their business and compliance risks have been appropriately 

identified, that their policies and procedures are appropriately tailored in light of their business and 

associated risks, and that their CCO is sufficiently empowered within the organization to effectively 

perform his/her responsibilities. The staff observed fewer compliance-related issues at the registrants 

examined that had developed appropriate controls in each of the areas identified in this Risk Alert. 

The staff welcomes comments and suggestions about how the Commission’s examination program can 

better fulfill its mission to promote compliance, prevent fraud, monitor risk, and inform SEC policy. If 

you suspect or observe activity that may violate the federal securities laws or otherwise operates to harm 

investors, please notify us at http://www.sec.gov/complaint/info_tipscomplaint.shtml.

This Risk Alert is intended to highlight for firms risks and issues that the staff has identified. In addition, this Risk 

Alert describes factors that firms may consider to (i) assess their supervisory, compliance and/or other risk 

management systems related to these risks, and (ii) make any changes, as may be appropriate, to address or 

strengthen such systems. These factors are not exhaustive, nor will they constitute a safe harbor. Other factors 

besides those described in this Risk Alert may be appropriate to consider, and some of the factors may not be 

applicable to a particular firm’s business. While some of the factors discussed in this Risk Alert reflect existing 

regulatory requirements, they are not intended to alter such requirements. Moreover, future changes in laws or 

regulations may supersede some of the factors or issues raised here. The adequacy of supervisory, compliance and 

other risk management systems can be determined only with reference to the profile of each specific firm and other 

facts and circumstances.