What SEC examiners ask a small RIA for, and how to have it ready before the call

Why readiness matters more for smaller and newer firms right now

The Division’s fiscal year 2026 examination priorities, released on November 17, 2025, say that “the Division will prioritize examinations of advisers that have never been examined, with particular emphasis on recently registered advisers.” The same document describes the assessment of compliance programs as “a fundamental part of the examination process,” with core areas including “marketing, valuation, trading, portfolio management, disclosure and filings, and custody.”

Time since registration or since the last exam is also one of the firm-specific risk factors the staff lists for choosing which advisers to examine, in its September 2023 risk alert on scoping exams and requesting documents. A firm that registered with the SEC in the last few years, or has simply never been examined, should assume its turn is coming.

There is also a new rule in scope. The SEC’s 2024 amendments to Regulation S-P require a written incident response program for unauthorized access to customer information, notice to affected individuals as soon as practicable, and no later than 30 days after the firm becomes aware of it, and oversight of service providers. Advisers with less than $1.5 billion in assets under management count as smaller entities, and their compliance date was June 3, 2026. The FY2026 priorities say the Division will examine for compliance with these amendments.

How an exam unfolds, step by step

On October 1, 2026, the Division published The SEC Exam Handbook: A Practical Guide on Process and Engagement, which replaces and expands upon the Division’s previous examination brochure. Its description of the process is the most useful planning document a small firm can read, and it reduces to six stages.

1. The call and the letter. Most exams begin with “a brief call from staff to the chief compliance officer (CCO) or other regulatory contact to announce the exam.” A formal letter follows with an initial request for information under section 204(a) of the Advisers Act. Some exams are unannounced, in which case the staff hands over the request on arrival and holds an initial interview then.
2. Producing the initial request. The staff usually allows two weeks, and will grant “reasonable extensions of time or rolling productions, where appropriate.” The Handbook asks firms to request an extension as soon as they realize they will miss a deadline, and to send complete, organized files that follow the Division’s data delivery guidance.
3. Interviews and on-site work. Expect a possible initial interview with the CCO or other relevant personnel, followed by interviews with other employees that the staff schedules through the CCO or regulatory contact. One practical note: “The staff does not record or transcribe meetings and instructs participants not to do so either,” and it does not consent to AI notetaking tools in those meetings.
4. The exit conference. The staff typically discusses what it has found at an exit conference, and “we typically request that members of your senior management or board of directors attend the exit conference.” This is the firm’s chance to correct misunderstandings or add information.
5. The disposition letter. By statute, the firm receives a letter “within 180 days” of the later of the end of the on-site work or the staff’s receipt of all requested records. The letter says the exam has concluded, has concluded without findings, or asks for corrective action. For certain complex exams, that deadline can be extended by a further 180 days. Most exams end with the third kind: a deficiency letter.
6. The response. The staff “will typically request that you respond within 30 days.” The response should describe the steps taken, or to be taken, to address each issue and prevent it from recurring. If the staff has comments on the response, it will “strive to provide them within 60 days of your response.”

The practical lesson is that the first two weeks matter most. The interviews, the exit conference and the deficiency letter are all shaped by what the firm produced, and how quickly and completely it produced it.

What is on the initial request list

The appendix to the September 2023 risk alert lists the documents the staff typically requests at the start of an exam of an adviser with no additional activities, such as managing private funds. It is long, but for a small advisory firm it groups into the eight areas below. For each area, the table quotes or summarizes the SEC’s list, then notes where those records tend to live at a small RIA, which is usually where the delay comes from.

Two things stand out. First, several items ask for what was in effect during a period, not what is true today. A firm that overwrites its compliance manual each year cannot easily show which version applied last March. Second, the appendix refers to an “examination period” and a “review period” without fixing their length. Expect the request letter itself to name the dates it covers, and keep records in a way that lets you slice them by date.

What the staff most often finds at newer firms

In March 2023, the Division published Observations from Examinations of Newly-Registered Advisers. Its findings line up closely with the request list above, because the request list is how the staff tests them.

• Policies that don’t fit the firm. Compliance policies “did not adequately address certain risk areas applicable to the firm, such as portfolio management and fee billing,” lacked procedures to enforce them, or were not followed by advisory staff.
• Annual reviews that didn’t review. Reviews did not assess whether the policies were adequate or were being implemented effectively. The alert points to off-the-shelf compliance manuals that were not tailored to the firm, possibly insufficient compliance resources, and outsourced functions that were never assessed.
• Conflicts from wearing several hats. Staff holding multiple roles created conflicts that were neither disclosed nor mitigated.
• Disclosure and filing errors. Required documents omitted or misstated information about fees, services, business operations, disciplinary history, websites and conflicts. Some filings were late or never made.
• Marketing claims that couldn’t be backed up. Materials contained misleading statements about credentials, third-party rankings and performance, and some factual claims could not be substantiated.

Each of these is a documentation problem as much as a conduct problem. A firm that bills correctly but cannot show how a fee was calculated, or tests its policies but never writes the test down, looks the same to an examiner as one that does neither.

Building an exam-ready file: eleven things to keep current

None of the items below is new. The difference is keeping them current all year, in a form that can be exported quickly, rather than assembling them under deadline.

1. Every version of the compliance manual, dated. Rule 204-2(a)(17) requires advisers to keep the policies and procedures in effect at any time within the past five years. Save each revision as a new, dated file with a one-line change log, rather than editing a single document.
2. A written annual review that shows what was tested. Rule 206(4)-7 requires a review, at least annually, of the adequacy of the firm’s policies and procedures and the effectiveness of their implementation, and Rule 204-2 requires records documenting that review. The 2023 findings suggest the weak point is effectiveness: write down what was sampled, what was found and what was changed.
3. A client account list you can export in minutes. It should include the fields the staff asks for (inception date, account type, balance and discretion) plus a list of clients who left during the period.
4. Fee evidence for any quarter. Keep the signed agreements (Rule 204-2(a)(10) requires keeping written client agreements), the fee schedule in effect for each household, and the calculation behind each bill: the value billed on, the rate and breakpoints applied, any householding, and any proration for partial periods. Check that it matches the fee description in Form ADV Part 2A.
5. The trade blotter and a trade error log, including how each error was resolved and who bore the cost.
6. Code of ethics records. Signed acknowledgments, and the holdings and transaction reports of access persons, with evidence that someone reviewed them.
7. A marketing file with substantiation. Keep a copy of each advertisement, presentation and significant website version, and next to each factual claim (a ranking, a credential, a performance figure) the evidence behind it.
8. A complaints log, even if most quarters read “none received.”
9. Business continuity and information security records. The business continuity plan, a log of cybersecurity incidents and how they were handled, and, now that the Regulation S-P compliance date has passed for smaller firms, the incident response program and records of service-provider oversight.
10. Firm financials. Balance sheet, trial balance, income statement, cash flow statement and general ledger, usually held by the outside accountant.
11. Filings that match the website. The Handbook notes that the staff will likely review a firm’s filings and website, and that keeping filings current and accurate can reduce findings. Read Form ADV, Form CRS and the website side by side once a year.

On retention: Rule 204-2(e)(1) requires most books and records to be kept “in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record,” with the first two years “in an appropriate office of the investment adviser.” Records kept electronically must be indexed so they can be found and retrieved, protected from loss or alteration, and backed up with a duplicate copy stored separately (Rule 204-2(g)).

Run a mock request once a year

The simplest way to find out whether a firm is ready is to ask it for the documents. A mock request takes the SEC’s own list and turns it into a short internal exercise, and it fits naturally inside the annual compliance review.

1. Pick a recent quarter and treat it as the review period.
2. Use the appendix to the September 2023 risk alert as the request list. Delete the items that don’t apply (private funds, for example) and keep everything else.
3. Give each item an owner and a source, such as the CCO, the operations lead, the custodian portal or the outside accountant, and note how long it takes to produce. Anything that takes more than a day, or depends on one person’s memory, is a finding.
4. Test, don’t just collect. For fees, pick a handful of households and recompute the quarter’s fee from the signed agreement: the right breakpoints, every account in the household included, excluded assets left out, and partial periods prorated. For marketing, pick three claims and find the evidence. For the code of ethics, confirm that every access person’s reports were received and reviewed.
5. Write it up in the annual review: what was requested, what was slow or missing, what was wrong, and what changed. That write-up is itself evidence of a review that assesses effectiveness, which is exactly what the 2023 findings say many newer firms lacked.

When the deficiency letter arrives

Because most exams end with a deficiency letter, it is worth planning the response before there is one. The Handbook asks for a written response, typically within 30 days, that describes the steps taken or planned for each finding, including steps to prevent it from happening again. It also says that the staff generally does not comment on whether proposed corrective actions are adequate, and that silence should not be read as agreement.

Speed matters beyond the letter itself. The Handbook says that “prompt and appropriate action to correct findings of potential violations may be a mitigating factor” when the staff decides whether to refer a matter to the Division of Enforcement, while noting that it is not dispositive. Each finding should also become a test in the next annual review, so that the fix is documented as working, not just promised.

The bottom line

For a small RIA, an SEC exam is mostly a test of whether the firm can show, quickly and from its own records, that it did what its policies and disclosures say. The SEC has now published the process, the request list and the most common findings. Firms that keep those records current all year, and rehearse producing them once a year, can spend the two weeks after the call answering questions rather than searching for files.