Skip to content
Menu

RIA annual compliance review planner

Rule 206(4)-7 asks every SEC-registered adviser to review its compliance policies at least once a year and leaves the how to the firm. Pick the start month, tick what the firm does and which policies the manual has, and get the annual compliance review as a dated plan: the areas to test, the records to pull, an owner for each step and a week-by-week schedule you can print or copy.

Rule 206(4)-7 and the review record

  • Review the policies and their implementation, no less frequently thanannually
    17 CFR 275.206(4)-7(b)
  • Months, length or areas the rule sets for the reviewnone
    17 CFR 275.206(4)-7
  • Issues the SEC expects policies to address, where relevant10
    Release IA-2204 (2003), section II.A.1
  • Records documenting the review, kept for5 years
    17 CFR 275.204-2(a)(17)(ii), (e)(1)
  • Of which in an appropriate office of the adviserfirst 2
    17 CFR 275.204-2(e)(1)
  • Policies kept if in effect within the past5 years
    17 CFR 275.204-2(a)(17)(i)
Rule text from the eCFR (as of October 20, 2026), read October 22, 2026, with the SEC’s 2003 adopting release from the Federal Register. The release also asks advisers to consider interim reviews after significant compliance events, business changes and regulatory developments.
Stipple engraving of thin folders in a desk sorter, one pulled forward, a desk clock behind
Card 01
A review is a year of files pulled forward one at a time; the plan says which, by whom and when.

What it computes

A dated plan for the annual review Rule 206(4)-7 asks every SEC-registered adviser to run: which areas to test, what to test in each, which Rule 204-2 records to pull as evidence, who owns each step, and the week each one runs. It opens with a scoping week and closes with a findings week and a sign-off week, and it gives the date until which the review’s own records are kept.

  1. 01Pick the month the review starts and how many weeks it runs (6 to 26). Week 1 starts on that month’s first Monday.
  2. 02Tick what the firm does. An activity switches on the area that covers it: discretion turns on portfolio management, advertising turns on marketing.
  3. 03Tick the policies your manual has. An area the firm needs but the manual lacks becomes a gap to close; a policy for an activity you left unticked goes to scoping, to confirm it still fits.
  4. 04Type a name in each Owner box, then Print the plan or Copy it into your compliance calendar.

The areas are not ours. When the SEC adopted the rule in 2003 it listed ten issues it expects an adviser’s policies to address “to the extent that they are relevant to that adviser”, and the planner keeps each one your answers make relevant. Pay-to-play joins them only for a firm with government clients. For the rule itself, its three duties and how a small firm meets them, read the Rule 206(4)-7 guide; for the policies the review tests, start from the RIA compliance manual template.

Worked example

The tool’s own default. A small adviser with a CCO and staff, a December 31 fiscal year end, discretionary accounts, its own trading, a website and fees billed from asset values. It has no custody and no government clients ticked, and its manual has a policy for every area except business continuity and pay-to-play. The review starts in January 2027 and runs twelve weeks, looking back over 2026.

Twelve weeks, January 4 to March 26, 2027

Worked example of a twelve-week annual compliance review plan
WeeksStepDatesOwner
1Scoping: last year, the business and the rulesJan 4 to Jan 8CCO
2 to 3Portfolio managementJan 11 to Jan 22Lead portfolio manager
3 to 4Trading practicesJan 18 to Jan 29Head of trading
4 to 5Personal trading and the code of ethicsJan 25 to Feb 5CCO
5 to 6Accuracy of disclosuresFeb 1 to Feb 12CCO
6 to 7Books and recordsFeb 8 to Feb 19Operations lead
7 to 9Marketing and advertisementsFeb 15 to Mar 5Marketing lead
9 to 10Valuation and fee billingMar 1 to Mar 12Operations lead
10Privacy of client informationMar 8 to Mar 12IT lead
11Findings and fixes, business continuity policy draftedMar 15 to Mar 19CCO
12Write-up, sign-off and filingMar 22 to Mar 26CCO

17 CFR 275.206(4)-7(b); 17 CFR 275.204-2(a)(17)(ii), (e)(1)

Eight areas are tested in weeks 2 to 10, each given weeks in proportion to its weight: the three heavy ones (portfolio management, books and records, marketing) get two units, the others one, so neighbouring areas share a week where they meet. Safeguarding client assets drops out because no custody is ticked; the manual still has a custody policy, so scoping asks whether it still fits. Business continuity is relevant to every firm, and with no plan in the manual it lands in week 11 as a policy to draft.

The review is signed off on Friday, March 26, 2027, inside the fiscal year that ends December 31, 2027. Its records are therefore kept until at least December 31, 2032, the first two years in an appropriate office of the adviser. The retention calculator gives the same date for any other record made in that year.

Documenting the review

Rule 206(4)-7 does not ask for a written report of the annual review. The duty to keep a record comes from the books and records rule, which lists “Any records documenting the investment adviser’s annual review of those policies and procedures” among the records an adviser must keep. A dated write-up of what was tested, what was found and what changed, filed with the working papers, is the common way to meet it, and it is the record an examiner can read without you in the room.

  • Review the policies and how well they work, no less frequently than annually
    17 CFR 275.206(4)-7(b)
  • Keep any records documenting the annual review
    17 CFR 275.204-2(a)(17)(ii)
  • Keep the policies in effect now or at any time within the past five years
    17 CFR 275.204-2(a)(17)(i)
  • Five years from the end of the fiscal year, the first two in an appropriate office5 years
    17 CFR 275.204-2(e)(1)

The SEC’s 2003 adopting release says what the review should weigh: “any compliance matters that arose during the previous year, any changes in the business activities of the adviser or its affiliates, and any changes in the Advisers Act or applicable regulations that might suggest a need to revise the policies or procedures.” Those three are the planner’s scoping week. The same release reads the record period plainly: advisers keep the review records “in an easily accessible place for at least five years after the end of the fiscal year in which the review was conducted, the first two years in an appropriate office of the investment adviser.”

The written annual report that release does require belongs to a different rule: a fund’s chief compliance officer reports to the fund board under Rule 38a-1. Rule 206(4)-7 carries no such report; the adviser’s duty is the record. Whoever runs your review, keep that record in a form you can produce. Firms that run the review in software can compare the workflows in the best RIA compliance software; firms that hire it out can read the best RIA compliance consultants against what this plan asks for, and the guide to an outsourced CCO covers the person named under paragraph (c).

The rule text

The whole rule is three short paragraphs, and the planner turns on the second. Each applies to an adviser “registered or required to be registered” with the SEC.

Two tests sit in that sentence. Adequacy asks whether the written policies still fit the business, which is why a missing policy shows up as a gap before any testing starts. Effectiveness asks whether people followed them, which is what the sampling in each area checks. The other two paragraphs set what is reviewed and who runs it: written policies “reasonably designed to prevent violation” of the Act, under paragraph (a), and an individual “responsible for administering the policies and procedures”, under paragraph (c).

Nothing in either rule names a month, a length or a list of areas. That freedom is why a plan helps: the dates are yours to set, and the plan is the evidence you set them. Before you rely on a date, check it with your compliance counsel; the planner is a reading of the rule text, not legal advice.

Where the rule says so

Every step in the planner, with the adopting release’s words for the area and the Rule 204-2 records named as its evidence. Open a row to read it. The full texts are on the eCFR for Rule 206(4)-7 and Rule 204-2, and in the Federal Register for the 2003 adopting release.

Scoping: last year, the business and the rules

Every firm. The release says the review “should consider” the year’s compliance matters, business changes and rule changes.

  • The policies and procedures, current and past five years 204-2(a)(17)(i)“A copy of the investment adviser’s policies and procedures formulated pursuant to § 275.206(4)-7(a) of this chapter that are in effect, or at any time within the past five years were in effect”
  • Records of earlier annual reviews 204-2(a)(17)(ii)“Any records documenting the investment adviser’s annual review of those policies and procedures conducted pursuant to § 275.206(4)-7(b) of this chapter”

IA-2204, section II.B.1; 204-2(a)(17)

Portfolio management

Firms that tick: manages client accounts with discretion.

The release: “Portfolio management processes, including allocation of investment opportunities among clients and consistency of portfolios with clients’ investment objectives, disclosures by the adviser, and applicable regulatory restrictions”

  • List of discretionary accounts 204-2(a)(8)“A list or other record of all accounts in which the investment adviser is vested with any discretionary power with respect to the funds, securities or transactions of any client.”
  • Powers of attorney and grants of discretion 204-2(a)(9)“All powers of attorney and other evidences of the granting of any discretionary authority by any client to the investment adviser, or copies thereof.”
  • Written agreements with clients 204-2(a)(10)“All written agreements (or copies thereof) entered into by the investment adviser with any client or otherwise relating to the business of such investment adviser as such.”
  • Order memoranda 204-2(a)(3)“A memorandum of each order given by the investment adviser for the purchase or sale of any security, of any instruction received by the investment adviser concerning the purchase, sale, receipt or delivery of a particular security, and of any modification or cancellation of any such order or instruction.”
  • Written communications on advice, funds and orders 204-2(a)(7)“Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given; (ii) Any receipt, disbursement or delivery of funds or securities; (iii) The placing or execution of any order to purchase or sell any security …”

IA-2204; 204-2(a)(3), (8)-(10)

Trading practices

Firms that tick: places client trades (block orders, research paid with brokerage).

The release: “Trading practices, including procedures by which the adviser satisfies its best execution obligation, uses client brokerage to obtain research and other services (‘soft dollar arrangements’), and allocates aggregated trades among clients”

  • Order memoranda 204-2(a)(3)“A memorandum of each order given by the investment adviser for the purchase or sale of any security, of any instruction received by the investment adviser concerning the purchase, sale, receipt or delivery of a particular security, and of any modification or cancellation of any such order or instruction.”
  • Written communications on advice, funds and orders 204-2(a)(7)“Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given; (ii) Any receipt, disbursement or delivery of funds or securities; (iii) The placing or execution of any order to purchase or sell any security …”

IA-2204; 204-2(a)(3), (7)

Personal trading and the code of ethics

Every firm.

The release: “Proprietary trading of the adviser and personal trading activities of supervised persons”

  • Code of ethics, violations, acknowledgments 204-2(a)(12)“A copy of the investment adviser’s code of ethics adopted and implemented pursuant to § 275.204A-1 that is in effect, or at any time within the past five years was in effect; (ii) A record of any violation of the code of ethics, and of any action taken as a result of the violation”
  • Access-person reports, names, approvals 204-2(a)(13)“A record of each report made by an access person as required by § 275.204A-1(b) … (ii) A record of the names of persons who are currently, or within the past five years were, access persons of the investment adviser”

More in the code of ethics guide.

IA-2204; 204A-1; 204-2(a)(12), (13)

Accuracy of disclosures

Every firm.

The release: “The accuracy of disclosures made to investors, clients, and regulators, including account statements and advertisements”

  • Brochures, supplements, Form CRS and delivery dates 204-2(a)(14)“A copy of each brochure, brochure supplement and Form CRS, and each amendment or revision to the brochure, brochure supplement and Form CRS”
  • Written agreements with clients 204-2(a)(10)“All written agreements (or copies thereof) entered into by the investment adviser with any client or otherwise relating to the business of such investment adviser as such.”

IA-2204; 204-2(a)(14)

Safeguarding client assets

Firms that tick: can move or hold client funds or securities.

The release: “Safeguarding of client assets from conversion or inappropriate use by advisory personnel”

  • Check books, bank statements, reconciliations 204-2(a)(4)“All check books, bank statements, cancelled checks and cash reconciliations of the investment adviser.”
  • Written communications on advice, funds and orders 204-2(a)(7)“Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given; (ii) Any receipt, disbursement or delivery of funds or securities; (iii) The placing or execution of any order to purchase or sell any security …”

IA-2204; 204-2(a)(4), (7)

Books and records

Every firm.

The release: “The accurate creation of required records and their maintenance in a manner that secures them from unauthorized alteration or use and protects them from untimely destruction”

  • Journals and cash receipts and disbursements 204-2(a)(1)“A journal or journals, including cash receipts and disbursements, records, and any other records of original entry forming the basis of entries in any ledger.”
  • General and auxiliary ledgers 204-2(a)(2)“General and auxiliary ledgers (or other comparable records) reflecting asset, liability, reserve, capital, income and expense accounts.”
  • Bills and statements 204-2(a)(5)“All bills or statements (or copies thereof), paid or unpaid, relating to the business of the investment adviser as such.”
  • Trial balances, financial statements, internal audit papers 204-2(a)(6)“All trial balances, financial statements, and internal audit working papers relating to the business of such investment adviser.”
  • Written communications on advice, funds and orders 204-2(a)(7)“Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given; (ii) Any receipt, disbursement or delivery of funds or securities; (iii) The placing or execution of any order to purchase or sell any security …”

More in the off-channel communications guide.

IA-2204; 204-2(a), (g)

Marketing and advertisements

Firms that tick: advertises: website, social media, testimonials or performance.

The release: “Marketing advisory services, including the use of solicitors”

  • Copies of each advertisement 204-2(a)(11)“A copy of each … Advertisement (as defined in § 275.206(4)-1(e)(1) of this chapter) that the investment adviser disseminates, directly or indirectly”
  • Testimonial and endorsement records 204-2(a)(15)“Documentation substantiating the adviser’s reasonable basis for believing that a testimonial or endorsement … complies with § 275.206(4)-1”
  • Performance backup 204-2(a)(16)“All accounts, books, internal working papers, and any other records or documents that are necessary to form the basis for or demonstrate the calculation of any performance or rate of return …”
  • Intended-audience records for hypothetical performance 204-2(a)(19)“A record of who the ‘intended audience’ is pursuant to § 275.206(4)-1(d)(6) and(e)(10)(ii)(B) of this chapter.”

More in the Marketing Rule guide.

IA-2204; 204-2(a)(11), (15), (16), (19)

Valuation and fee billing

Firms that tick: bills fees from the value of client assets.

The release: “Processes to value client holdings and assess fees based on those valuations”

  • Written agreements with clients 204-2(a)(10)“All written agreements (or copies thereof) entered into by the investment adviser with any client or otherwise relating to the business of such investment adviser as such.”
  • Bills and statements 204-2(a)(5)“All bills or statements (or copies thereof), paid or unpaid, relating to the business of the investment adviser as such.”

Also: the firm’s billing files and the valuations behind them (no Rule 204-2 paragraph names it).

IA-2204; 204-2(a)(5), (10)

Privacy of client information

Every firm.

The release: “Safeguards for the privacy protection of client records and information”

  • Regulation S-P policies, incidents and service-provider contracts 204-2(a)(25)“The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(1); (ii) The written documentation of any detected unauthorized access to or use of customer information …”

More in the Regulation S-P guide.

IA-2204; 204-2(a)(25)

Business continuity

Every firm.

The release: “Business continuity plans”

Also: the written plan and a dated note of the test (no Rule 204-2 paragraph names it).

IA-2204

Political contributions (pay-to-play)

Firms that tick: advises a government entity, or a pool one invests in.

Not in the release’s list. The planner adds it because Rule 204-2 names its records.

  • Pay-to-play lists: covered associates, government clients, contributions 204-2(a)(18)“Books and records that pertain to § 275.206(4)-5 containing a list or other record of: (A) The names, titles and business and residence addresses of all covered associates of the investment adviser”

204-2(a)(18)

To check the rest of the program beside the review, from Form ADV dates to the code of ethics, work through the RIA compliance checklist.