Keeping compliance policies current is becoming a growing challenge for investment advisers as business operations and regulatory expectations evolve. A recent Risk Alert from the US Securities and Exchange Commission (SEC) has highlighted how firms can fall short when their documented procedures no longer reflect how they operate, prompting RegTech provider Red Oak to advocate for more continuous oversight.
The alert identified six recurring weaknesses in advisers’ annual compliance reviews, ranging from outdated policies and incomplete assessments to inadequate documentation and corrective measures that were never implemented. The findings raise questions about whether periodic reviews alone can provide sufficient oversight of increasingly complex financial services operations.
Under Rule 206(4)-7, the SEC requires investment advisers to assess their compliance programmes at least once a year. Firms must evaluate whether their policies and procedures remain appropriate for their current activities and whether those controls are being followed. However, the gap between completing a formal review and maintaining effective controls throughout the year can leave firms exposed when their operations change.
The SEC’s Division of Examinations uses Risk Alerts to share common deficiencies identified during examinations. In its latest findings, the regulator highlighted policies that diverged from actual business practices, missed or delayed reviews, incomplete assessment procedures, departures from documented review processes, insufficient records and unimplemented corrective actions.
One issue has implications across the wider compliance framework: the failure to keep written policies aligned with operational reality. When employees work outside established procedures, firms may struggle to identify weaknesses, maintain accountability or ensure that corrective measures are effective. The SEC also flagged marketing procedures that continued to rely on requirements superseded by its Marketing Rule in 2022, underlining the risks of failing to update controls as regulations change.
An annual review can establish whether a compliance programme is appropriate at the time of assessment, but it cannot automatically account for every subsequent change. New products, evolving workflows and revised regulatory requirements can all create discrepancies between documented procedures and actual practices.
These gaps may persist until the next scheduled review or an examination brings them to light. For compliance teams, the challenge is therefore not limited to conducting the required annual assessment. They must also ensure that policies remain relevant and are consistently applied between reviews.
This is where technology-led approaches to compliance monitoring can play a role. By identifying discrepancies as they emerge, firms may be better positioned to investigate potential weaknesses and update controls before issues become more serious.
Red Oak is addressing this challenge through Mira, a solution that develops supervision policies from a firm’s own handbook and cross-references them against SEC and Financial Industry Regulatory Authority (FINRA) precedent.
Rather than relying on generic templates, the system is designed to reflect the specific policies and requirements established by each firm. Its continuous monitoring capabilities are intended to identify instances where actual practices diverge from those documented requirements, allowing compliance teams to respond as issues arise.
Depending on the circumstances, this may involve addressing employee behaviour, revising policies to reflect operational changes, or implementing both measures. The objective is to reduce the time between a compliance gap emerging and the firm recognising that corrective action is needed.
Red Oak also offers Advertising Review, which assesses marketing content against current compliance standards at the point of review. The solution addresses a related risk highlighted by the SEC: marketing procedures that fail to keep pace with regulatory changes.
The broader issue extends beyond the completion of an annual compliance assessment. Firms must maintain a framework that evolves alongside their business and regulatory obligations, with effective documentation supported by consistent implementation. Red Oak’s tools aim to help advisers move towards this model by combining policy-based supervision with ongoing monitoring and advertising checks.
Copyright © 2026 FinTech Global
Copyright © 2026 RegTech Analyst
