Investment advisers that rely on annual compliance reviews risk overlooking gaps between written policies and day-to-day practices, according to a recent Risk Alert from the US Securities and Exchange Commission (SEC). RegTech provider Red Oak argues that continuous monitoring can help firms identify and address these discrepancies before they become regulatory problems.
Under the SEC’s Compliance Rule, Rule 206(4)-7, investment advisers must review their compliance programmes at least annually. The assessment must establish whether their policies and procedures remain adequate for their current business activities and whether employees are following them in practice. As firms adapt to new technologies, business models and regulatory requirements, policies can quickly become outdated, leaving gaps that may only emerge during an examination.
The SEC’s Division of Examinations uses Risk Alerts to highlight recurring weaknesses identified by its examiners. The latest alert identified six areas of concern: policies that do not reflect actual practices, late or missing annual reviews, incomplete review procedures, reviews that do not follow a firm’s documented processes, inadequate record-keeping, and corrective actions that are identified but not implemented.
The disconnect between written policies and actual practices is particularly significant because it can contribute to failures across the other areas. When employees do not follow established procedures, compliance issues can go undetected, accountability can weaken and remediation efforts can fall short. The SEC also highlighted outdated marketing procedures that continued to reflect requirements superseded by the SEC Marketing Rule in 2022, demonstrating that policy drift can extend beyond supervision.
The findings highlight the challenge of maintaining effective compliance programmes as business operations and regulatory expectations evolve. Even firms with established policies can find their documentation falling out of step with their activities.
An annual review provides a snapshot of a firm’s compliance position at a particular point in time. However, subsequent operational changes can create new gaps before the next assessment takes place. Without ongoing oversight, firms may remain unaware of these discrepancies until a further review or regulatory examination exposes them.
Red Oak has developed Mira, a tool that builds supervision policies from a firm’s own handbook and cross-references them against SEC and Financial Industry Regulatory Authority (FINRA) precedent. The approach is designed to ensure that the policies being enforced reflect the firm’s documented requirements rather than relying on generic templates.
Mira monitors compliance on an ongoing basis, enabling firms to identify deviations between established policies and actual practices as they occur. This gives compliance teams an opportunity to address issues promptly, whether by correcting employee behaviour, updating policies to reflect operational changes, or taking both steps.
The approach shifts compliance oversight away from an annual assessment towards continuous alignment between documented requirements and business activities. Rather than discovering discrepancies retrospectively, firms can identify emerging issues earlier and take corrective action before they become more significant.
Red Oak’s Advertising Review tool also assesses marketing content against current compliance standards at the point of review. This is designed to help firms ensure published materials reflect current regulatory requirements, rather than relying on procedures based on outdated rules. Together, Red Oak’s tools highlight how continuous monitoring can complement annual compliance reviews, helping advisers maintain alignment between written policies and business practices throughout the year.
Copyright © 2026 FinTech Global
