RIA annual compliance review planner
Rule 206(4)-7 asks every SEC-registered adviser to review its compliance policies at least once a year and leaves the how to the firm. Pick the start month, tick what the firm does and which policies the manual has, and get the annual compliance review as a dated plan: the areas to test, the records to pull, an owner for each step and a week-by-week schedule you can print or copy.
Annual review planner: the tool
Annual review planneradviserdeck.com
Pre-filled with an example: a small adviser with a CCO and staff starting its review in January 2027. Change any answer and the plan redraws; names typed in the Owner boxes stay until you press Reset.
Week 1 begins on the first Monday of this month.
From 6 to 26. Twelve is a common pace for a small firm.
Sets how long the review's records are kept.
Sets the default owner of each area.
The review runs
Jan 4 to Mar 26, 2027
17 CFR 275.206(4)-7(b)
- Week 1: scopingJan 4
- Weeks 2 to 10: testingJan 11
- Week 11: findings and fixesMar 15
- Week 12: sign-off byMar 26
- Keep the review’s records until at leastDec 31, 203217 CFR 275.204-2(a)(17)(ii), (e)(1)
The schedule, week by week
| Step | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Scoping | Week 1 | |||||||||||
| Portfolio management | Week 2 | Week 3 | ||||||||||
| Trading practices | Week 3 | Week 4 | ||||||||||
| Personal trading and the code of ethics | Week 4 | Week 5 | ||||||||||
| Accuracy of disclosures | Week 5 | Week 6 | ||||||||||
| Books and records | Week 6 | Week 7 | ||||||||||
| Marketing and advertisements | Week 7 | Week 8 | Week 9 | |||||||||
| Valuation and fee billing | Week 9 | Week 10 | ||||||||||
| Privacy of client information | Week 10 | |||||||||||
| Findings and fixes | Week 11 | |||||||||||
| Write-up, sign-off and filing | Week 12 |
Week 1 starts on Monday, Jan 4, 2027
The plan, step by step
Scoping: last year, the business and the rules
Week 1, Jan 4 to Jan 8, 2027
- List the compliance matters that arose during the year under review.
- List changes in the business of the firm or its affiliates.
- List changes in the Advisers Act or its rules since the last review.
- Read last year’s findings and check each one was fixed.
- Confirm the safeguarding client assets policy still fits: the activity it covers is not ticked this year.
Evidence to pull
- The policies and procedures, current and past five years 204-2(a)(17)(i)
- Records of earlier annual reviews 204-2(a)(17)(ii)
IA-2204; 204-2(a)(17)
Portfolio management
Weeks 2 to 3, Jan 11 to Jan 22, 2027
- Sample client accounts and compare holdings with each client’s stated objectives and restrictions.
- Check how investment opportunities were shared across clients against the written allocation policy.
- Match the list of discretionary accounts to the signed grants of authority.
Evidence to pull
- List of discretionary accounts 204-2(a)(8)
- Powers of attorney and grants of discretion 204-2(a)(9)
- Written agreements with clients 204-2(a)(10)
- Order memoranda 204-2(a)(3)
- Written communications on advice, funds and orders 204-2(a)(7)
IA-2204; 204-2(a)(3), (8)-(10)
Trading practices
Weeks 3 to 4, Jan 18 to Jan 29, 2027
- Sample trades for the best-execution evidence your policy says you keep.
- Check each aggregated order was allocated across clients the way the policy says.
- List any research or services paid with client brokerage and check the brochure describes them.
Evidence to pull
- Order memoranda 204-2(a)(3)
- Written communications on advice, funds and orders 204-2(a)(7)
IA-2204; 204-2(a)(3), (7)
Personal trading and the code of ethics
Weeks 4 to 5, Jan 25 to Feb 5, 2027
- Check every access person’s holdings and transaction reports came in and were reviewed.
- Match approvals on file to every IPO or limited-offering purchase by an access person.
- Confirm each supervised person acknowledged the current code and its amendments.
Evidence to pull
- Code of ethics, violations, acknowledgments 204-2(a)(12)
- Access-person reports, names, approvals 204-2(a)(13)
IA-2204; 204A-1; 204-2(a)(12), (13)
Accuracy of disclosures
Weeks 5 to 6, Feb 1 to Feb 12, 2027
- Read the brochure, supplements and Form CRS against what the firm actually did this year.
- Check the dates each brochure and Form CRS went to new clients.
- Sample account statements and fee disclosures for accuracy.
Evidence to pull
- Brochures, supplements, Form CRS and delivery dates 204-2(a)(14)
- Written agreements with clients 204-2(a)(10)
IA-2204; 204-2(a)(14)
Books and records
Weeks 6 to 7, Feb 8 to Feb 19, 2027
- Ask for a sample of each required record and time how long it takes to produce.
- Check electronic records are indexed, duplicated and limited to authorized people, as Rule 204-2(g) asks.
- Check that every channel used for client business, texts and messaging apps included, is captured.
Evidence to pull
- Journals and cash receipts and disbursements 204-2(a)(1)
- General and auxiliary ledgers 204-2(a)(2)
- Bills and statements 204-2(a)(5)
- Trial balances, financial statements, internal audit papers 204-2(a)(6)
- Written communications on advice, funds and orders 204-2(a)(7)
IA-2204; 204-2(a), (g)
Marketing and advertisements
Weeks 7 to 9, Feb 15 to Mar 5, 2027
- Sample the year’s advertisements, website and social posts included, and check each was reviewed before use.
- Pull the backup for every performance figure the firm showed.
- Check each testimonial or endorsement has its disclosures and documentation on file.
Evidence to pull
- Copies of each advertisement 204-2(a)(11)
- Testimonial and endorsement records 204-2(a)(15)
- Performance backup 204-2(a)(16)
- Intended-audience records for hypothetical performance 204-2(a)(19)
IA-2204; 204-2(a)(11), (15), (16), (19)
Valuation and fee billing
Weeks 9 to 10, Mar 1 to Mar 12, 2027
- Recalculate a sample of fee invoices from the agreement and the asset value used.
- Check how holdings without a market price were valued against the policy.
Evidence to pull
- Written agreements with clients 204-2(a)(10)
- Bills and statements 204-2(a)(5)
- The firm’s billing files and the valuations behind them
IA-2204; 204-2(a)(5), (10)
Privacy of client information
Week 10, Mar 8 to Mar 12, 2027
- Review any detected unauthorized access to customer information and the notice decision made.
- Check the contracts and oversight of service providers that hold client information.
Evidence to pull
- Regulation S-P policies, incidents and service-provider contracts 204-2(a)(25)
IA-2204; 204-2(a)(25)
Findings and fixes
Week 11, Mar 15 to Mar 19, 2027
- List each finding with the area, what was tested, what was found and who fixes it by when.
- Amend the policies where a test showed they no longer fit the business.
- Policy gap: the firm does this but the manual has no business continuity policy. Draft one.
206(4)-7(a), (b)
Write-up, sign-off and filing
Week 12, Mar 22 to Mar 26, 2027
- Write up the review: the year covered, the areas tested, the findings and the fixes, dated and signed off.
- File the write-up with its working papers as the record of the review.
- Keep that record until at least Dec 31, 2032, in an appropriate office through Dec 31, 2029.
Evidence to pull
- The policies and procedures, current and past five years 204-2(a)(17)(i)
- Records of earlier annual reviews 204-2(a)(17)(ii)
204-2(a)(17), (e)(1)
Rule 206(4)-7 and the review recordCard 01
- Review the policies and their implementation, no less frequently thanannually17 CFR 275.206(4)-7(b)
- Months, length or areas the rule sets for the reviewnone17 CFR 275.206(4)-7
- Issues the SEC expects policies to address, where relevant10Release IA-2204 (2003), section II.A.1
- Records documenting the review, kept for5 years17 CFR 275.204-2(a)(17)(ii), (e)(1)
- Of which in an appropriate office of the adviserfirst 217 CFR 275.204-2(e)(1)
- Policies kept if in effect within the past5 years17 CFR 275.204-2(a)(17)(i)

What it computes
A dated plan for the annual review Rule 206(4)-7 asks every SEC-registered adviser to run: which areas to test, what to test in each, which Rule 204-2 records to pull as evidence, who owns each step, and the week each one runs. It opens with a scoping week and closes with a findings week and a sign-off week, and it gives the date until which the review’s own records are kept.
- 01Pick the month the review starts and how many weeks it runs (6 to 26). Week 1 starts on that month’s first Monday.
- 02Tick what the firm does. An activity switches on the area that covers it: discretion turns on portfolio management, advertising turns on marketing.
- 03Tick the policies your manual has. An area the firm needs but the manual lacks becomes a gap to close; a policy for an activity you left unticked goes to scoping, to confirm it still fits.
- 04Type a name in each Owner box, then Print the plan or Copy it into your compliance calendar.
The areas are not ours. When the SEC adopted the rule in 2003 it listed ten issues it expects an adviser’s policies to address “to the extent that they are relevant to that adviser”, and the planner keeps each one your answers make relevant. Pay-to-play joins them only for a firm with government clients. For the rule itself, its three duties and how a small firm meets them, read the Rule 206(4)-7 guide; for the policies the review tests, start from the RIA compliance manual template.
Worked example
The tool’s own default. A small adviser with a CCO and staff, a December 31 fiscal year end, discretionary accounts, its own trading, a website and fees billed from asset values. It has no custody and no government clients ticked, and its manual has a policy for every area except business continuity and pay-to-play. The review starts in January 2027 and runs twelve weeks, looking back over 2026.
Twelve weeks, January 4 to March 26, 2027
| Weeks | Step | Dates | Owner |
|---|---|---|---|
| 1 | Scoping: last year, the business and the rules | Jan 4 to Jan 8 | CCO |
| 2 to 3 | Portfolio management | Jan 11 to Jan 22 | Lead portfolio manager |
| 3 to 4 | Trading practices | Jan 18 to Jan 29 | Head of trading |
| 4 to 5 | Personal trading and the code of ethics | Jan 25 to Feb 5 | CCO |
| 5 to 6 | Accuracy of disclosures | Feb 1 to Feb 12 | CCO |
| 6 to 7 | Books and records | Feb 8 to Feb 19 | Operations lead |
| 7 to 9 | Marketing and advertisements | Feb 15 to Mar 5 | Marketing lead |
| 9 to 10 | Valuation and fee billing | Mar 1 to Mar 12 | Operations lead |
| 10 | Privacy of client information | Mar 8 to Mar 12 | IT lead |
| 11 | Findings and fixes, business continuity policy drafted | Mar 15 to Mar 19 | CCO |
| 12 | Write-up, sign-off and filing | Mar 22 to Mar 26 | CCO |
17 CFR 275.206(4)-7(b); 17 CFR 275.204-2(a)(17)(ii), (e)(1)
Eight areas are tested in weeks 2 to 10, each given weeks in proportion to its weight: the three heavy ones (portfolio management, books and records, marketing) get two units, the others one, so neighbouring areas share a week where they meet. Safeguarding client assets drops out because no custody is ticked; the manual still has a custody policy, so scoping asks whether it still fits. Business continuity is relevant to every firm, and with no plan in the manual it lands in week 11 as a policy to draft.
The review is signed off on Friday, March 26, 2027, inside the fiscal year that ends December 31, 2027. Its records are therefore kept until at least December 31, 2032, the first two years in an appropriate office of the adviser. The retention calculator gives the same date for any other record made in that year.
Documenting the review
Rule 206(4)-7 does not ask for a written report of the annual review. The duty to keep a record comes from the books and records rule, which lists “Any records documenting the investment adviser’s annual review of those policies and procedures” among the records an adviser must keep. A dated write-up of what was tested, what was found and what changed, filed with the working papers, is the common way to meet it, and it is the record an examiner can read without you in the room.
- Review the policies and how well they work, no less frequently than annually17 CFR 275.206(4)-7(b)
- Keep any records documenting the annual review17 CFR 275.204-2(a)(17)(ii)
- Keep the policies in effect now or at any time within the past five years17 CFR 275.204-2(a)(17)(i)
- Five years from the end of the fiscal year, the first two in an appropriate office5 years17 CFR 275.204-2(e)(1)
The SEC’s 2003 adopting release says what the review should weigh: “any compliance matters that arose during the previous year, any changes in the business activities of the adviser or its affiliates, and any changes in the Advisers Act or applicable regulations that might suggest a need to revise the policies or procedures.” Those three are the planner’s scoping week. The same release reads the record period plainly: advisers keep the review records “in an easily accessible place for at least five years after the end of the fiscal year in which the review was conducted, the first two years in an appropriate office of the investment adviser.”
The written annual report that release does require belongs to a different rule: a fund’s chief compliance officer reports to the fund board under Rule 38a-1. Rule 206(4)-7 carries no such report; the adviser’s duty is the record. Whoever runs your review, keep that record in a form you can produce. Firms that run the review in software can compare the workflows in the best RIA compliance software; firms that hire it out can read the best RIA compliance consultants against what this plan asks for, and the guide to an outsourced CCO covers the person named under paragraph (c).
The rule text
The whole rule is three short paragraphs, and the planner turns on the second. Each applies to an adviser “registered or required to be registered” with the SEC.
Two tests sit in that sentence. Adequacy asks whether the written policies still fit the business, which is why a missing policy shows up as a gap before any testing starts. Effectiveness asks whether people followed them, which is what the sampling in each area checks. The other two paragraphs set what is reviewed and who runs it: written policies “reasonably designed to prevent violation” of the Act, under paragraph (a), and an individual “responsible for administering the policies and procedures”, under paragraph (c).
Nothing in either rule names a month, a length or a list of areas. That freedom is why a plan helps: the dates are yours to set, and the plan is the evidence you set them. Before you rely on a date, check it with your compliance counsel; the planner is a reading of the rule text, not legal advice.
Where the rule says so
Every step in the planner, with the adopting release’s words for the area and the Rule 204-2 records named as its evidence. Open a row to read it. The full texts are on the eCFR for Rule 206(4)-7 and Rule 204-2, and in the Federal Register for the 2003 adopting release.
Scoping: last year, the business and the rules
Every firm. The release says the review “should consider” the year’s compliance matters, business changes and rule changes.
- The policies and procedures, current and past five years 204-2(a)(17)(i)“A copy of the investment adviser’s policies and procedures formulated pursuant to § 275.206(4)-7(a) of this chapter that are in effect, or at any time within the past five years were in effect”
- Records of earlier annual reviews 204-2(a)(17)(ii)“Any records documenting the investment adviser’s annual review of those policies and procedures conducted pursuant to § 275.206(4)-7(b) of this chapter”
IA-2204, section II.B.1; 204-2(a)(17)
Portfolio management
Firms that tick: manages client accounts with discretion.
The release: “Portfolio management processes, including allocation of investment opportunities among clients and consistency of portfolios with clients’ investment objectives, disclosures by the adviser, and applicable regulatory restrictions”
- List of discretionary accounts 204-2(a)(8)“A list or other record of all accounts in which the investment adviser is vested with any discretionary power with respect to the funds, securities or transactions of any client.”
- Powers of attorney and grants of discretion 204-2(a)(9)“All powers of attorney and other evidences of the granting of any discretionary authority by any client to the investment adviser, or copies thereof.”
- Written agreements with clients 204-2(a)(10)“All written agreements (or copies thereof) entered into by the investment adviser with any client or otherwise relating to the business of such investment adviser as such.”
- Order memoranda 204-2(a)(3)“A memorandum of each order given by the investment adviser for the purchase or sale of any security, of any instruction received by the investment adviser concerning the purchase, sale, receipt or delivery of a particular security, and of any modification or cancellation of any such order or instruction.”
- Written communications on advice, funds and orders 204-2(a)(7)“Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given; (ii) Any receipt, disbursement or delivery of funds or securities; (iii) The placing or execution of any order to purchase or sell any security …”
IA-2204; 204-2(a)(3), (8)-(10)
Trading practices
Firms that tick: places client trades (block orders, research paid with brokerage).
The release: “Trading practices, including procedures by which the adviser satisfies its best execution obligation, uses client brokerage to obtain research and other services (‘soft dollar arrangements’), and allocates aggregated trades among clients”
- Order memoranda 204-2(a)(3)“A memorandum of each order given by the investment adviser for the purchase or sale of any security, of any instruction received by the investment adviser concerning the purchase, sale, receipt or delivery of a particular security, and of any modification or cancellation of any such order or instruction.”
- Written communications on advice, funds and orders 204-2(a)(7)“Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given; (ii) Any receipt, disbursement or delivery of funds or securities; (iii) The placing or execution of any order to purchase or sell any security …”
IA-2204; 204-2(a)(3), (7)
Personal trading and the code of ethics
Every firm.
The release: “Proprietary trading of the adviser and personal trading activities of supervised persons”
- Code of ethics, violations, acknowledgments 204-2(a)(12)“A copy of the investment adviser’s code of ethics adopted and implemented pursuant to § 275.204A-1 that is in effect, or at any time within the past five years was in effect; (ii) A record of any violation of the code of ethics, and of any action taken as a result of the violation”
- Access-person reports, names, approvals 204-2(a)(13)“A record of each report made by an access person as required by § 275.204A-1(b) … (ii) A record of the names of persons who are currently, or within the past five years were, access persons of the investment adviser”
More in the code of ethics guide.
IA-2204; 204A-1; 204-2(a)(12), (13)
Accuracy of disclosures
Every firm.
The release: “The accuracy of disclosures made to investors, clients, and regulators, including account statements and advertisements”
- Brochures, supplements, Form CRS and delivery dates 204-2(a)(14)“A copy of each brochure, brochure supplement and Form CRS, and each amendment or revision to the brochure, brochure supplement and Form CRS”
- Written agreements with clients 204-2(a)(10)“All written agreements (or copies thereof) entered into by the investment adviser with any client or otherwise relating to the business of such investment adviser as such.”
IA-2204; 204-2(a)(14)
Safeguarding client assets
Firms that tick: can move or hold client funds or securities.
The release: “Safeguarding of client assets from conversion or inappropriate use by advisory personnel”
- Check books, bank statements, reconciliations 204-2(a)(4)“All check books, bank statements, cancelled checks and cash reconciliations of the investment adviser.”
- Written communications on advice, funds and orders 204-2(a)(7)“Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given; (ii) Any receipt, disbursement or delivery of funds or securities; (iii) The placing or execution of any order to purchase or sell any security …”
IA-2204; 204-2(a)(4), (7)
Books and records
Every firm.
The release: “The accurate creation of required records and their maintenance in a manner that secures them from unauthorized alteration or use and protects them from untimely destruction”
- Journals and cash receipts and disbursements 204-2(a)(1)“A journal or journals, including cash receipts and disbursements, records, and any other records of original entry forming the basis of entries in any ledger.”
- General and auxiliary ledgers 204-2(a)(2)“General and auxiliary ledgers (or other comparable records) reflecting asset, liability, reserve, capital, income and expense accounts.”
- Bills and statements 204-2(a)(5)“All bills or statements (or copies thereof), paid or unpaid, relating to the business of the investment adviser as such.”
- Trial balances, financial statements, internal audit papers 204-2(a)(6)“All trial balances, financial statements, and internal audit working papers relating to the business of such investment adviser.”
- Written communications on advice, funds and orders 204-2(a)(7)“Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given; (ii) Any receipt, disbursement or delivery of funds or securities; (iii) The placing or execution of any order to purchase or sell any security …”
More in the off-channel communications guide.
IA-2204; 204-2(a), (g)
Marketing and advertisements
Firms that tick: advertises: website, social media, testimonials or performance.
The release: “Marketing advisory services, including the use of solicitors”
- Copies of each advertisement 204-2(a)(11)“A copy of each … Advertisement (as defined in § 275.206(4)-1(e)(1) of this chapter) that the investment adviser disseminates, directly or indirectly”
- Testimonial and endorsement records 204-2(a)(15)“Documentation substantiating the adviser’s reasonable basis for believing that a testimonial or endorsement … complies with § 275.206(4)-1”
- Performance backup 204-2(a)(16)“All accounts, books, internal working papers, and any other records or documents that are necessary to form the basis for or demonstrate the calculation of any performance or rate of return …”
- Intended-audience records for hypothetical performance 204-2(a)(19)“A record of who the ‘intended audience’ is pursuant to § 275.206(4)-1(d)(6) and(e)(10)(ii)(B) of this chapter.”
More in the Marketing Rule guide.
IA-2204; 204-2(a)(11), (15), (16), (19)
Valuation and fee billing
Firms that tick: bills fees from the value of client assets.
The release: “Processes to value client holdings and assess fees based on those valuations”
- Written agreements with clients 204-2(a)(10)“All written agreements (or copies thereof) entered into by the investment adviser with any client or otherwise relating to the business of such investment adviser as such.”
- Bills and statements 204-2(a)(5)“All bills or statements (or copies thereof), paid or unpaid, relating to the business of the investment adviser as such.”
Also: the firm’s billing files and the valuations behind them (no Rule 204-2 paragraph names it).
IA-2204; 204-2(a)(5), (10)
Privacy of client information
Every firm.
The release: “Safeguards for the privacy protection of client records and information”
- Regulation S-P policies, incidents and service-provider contracts 204-2(a)(25)“The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(1); (ii) The written documentation of any detected unauthorized access to or use of customer information …”
More in the Regulation S-P guide.
IA-2204; 204-2(a)(25)
Business continuity
Every firm.
The release: “Business continuity plans”
Also: the written plan and a dated note of the test (no Rule 204-2 paragraph names it).
IA-2204
Political contributions (pay-to-play)
Firms that tick: advises a government entity, or a pool one invests in.
Not in the release’s list. The planner adds it because Rule 204-2 names its records.
- Pay-to-play lists: covered associates, government clients, contributions 204-2(a)(18)“Books and records that pertain to § 275.206(4)-5 containing a list or other record of: (A) The names, titles and business and residence addresses of all covered associates of the investment adviser”
204-2(a)(18)
To check the rest of the program beside the review, from Form ADV dates to the code of ethics, work through the RIA compliance checklist.