Investment Adviser Annual Compliance Review Checklist Template

Assigned to the CCO. The scope answers recorded here decide which later phases and tasks appear.

• Record the review period and the fiscal year end — the ADV and brochure deadlines are offset from it
• Answer the scope questions — SEC or state registered, custody Yes or No, retail clients receiving Form CRS Yes or No
• Update the compliance risk inventory — new products, strategies, custodians, staff, offices and conflicts since the last review
• Collect the year’s inputs — last year’s findings, exam deficiency letters, interim testing, complaints, trade errors and regulatory changes
• Assign an owner to each test area — the person who runs a process should not be the only one who tests it
• Confirm the CCO designation — that the CCO is knowledgeable about the Advisers Act and has the authority and resources to run the programme

• Test fee billing against advisory agreements and the brochure — sample invoices for rate, breakpoints, household aggregation and billing on cash
• Review the conflicts inventory against disclosure — every material conflict is eliminated or fully and fairly disclosed
• Test portfolio management against client objectives and restrictions — sample accounts for drift and breached restrictions
• Review trading, allocation and best execution — aggregation and allocation records, the trade error log and the best execution review
• Review valuation of hard-to-value holdings — pricing sources, overrides and who approved them
• Test the business continuity and succession plan — contact lists, backups and who acts if a key person is unavailable

• Reconcile the access person list and personal trading reports — initial holdings within 10 days of becoming an access person, annual holdings and quarterly transaction reports within 30 days of quarter end (Rule 204A-1)
• Check pre-approval of IPO and limited offering purchases by access persons — and test personal trades against the restricted list
• Collect each supervised person’s written acknowledgement of the code of ethics — and log any code violations and the action taken
• Review a sample of advertisements against the marketing rule — net with gross performance, testimonial and endorsement disclosures, third-party ratings and hypothetical performance controls
• Check the Form ADV Part 1A Item 5.L marketing answers — they must match what the firm actually does
• Test books and records under Rule 204-2 — required records exist, are retrievable, and electronic communications are captured on approved channels

SEC-registered advisers test against amended Regulation S-P. For state-registered advisers the task list switches to the FTC Safeguards Rule and state rules.

• Review the written incident response programme — it must cover detecting, assessing, containing and controlling unauthorised access to customer information
• Test the customer notification procedure — affected individuals notified as soon as practicable and no later than 30 days after the firm becomes aware
• Review service provider oversight — providers must notify the firm within 72 hours of a breach affecting its customer information
• Review access controls and the user list — leavers removed, privileged access justified, multi-factor authentication in place
• Run or review an incident tabletop exercise — record what worked and what changes
• State registered only: test against the FTC Safeguards Rule — and your state’s information security rule; many states follow the NASAA model rule

Shown only when the firm has custody of client funds or securities. State-registered advisers follow their state’s custody rule, which can differ.

• Identify every source of custody — fee deduction, standing letters of authority, access to client credentials, trustee roles, general partner of a pooled vehicle
• Confirm a qualified custodian holds the assets — and that the firm has a reasonable basis to believe clients receive account statements at least quarterly
• Track the surprise examination by an independent public accountant — the accountant files Form ADV-E within 120 days of the exam date
• Pooled vehicles: confirm audited financial statements reached investors — within 120 days of fiscal year end; 180 days for a fund of funds
• Reconcile custody answers in Form ADV Item 9 — amounts, number of clients and the custodians named

Due dates offset from the fiscal year end. The Form CRS task shows for SEC-registered firms with retail clients; the state task shows for state-registered firms.

• Update Part 1A, including regulatory assets under management — and recheck registration eligibility; an SEC adviser below $90 million generally must switch to the states
• Update the Part 2A brochure and Part 2B supplements — reflecting conflicts, fees and practices found in Phases 2 to 5
• File the annual updating amendment through IARD — within 90 days of the fiscal year end
• Deliver the brochure or a summary of material changes — within 120 days of the fiscal year end, with an offer of the full brochure
• Review Form CRS for material inaccuracy — file amendments within 30 days and communicate them to retail clients within 60 days
• State registered: complete state-specific filings — IARD renewal, adviser representative registrations and any financial statement, bonding or net worth requirement

The CCO signs the report. Senior management approval is a separate task assigned to a named principal, and the checklist stops until it is answered.

• Write the annual review report — scope, tests performed, findings rated by risk, and changes to policies
• Assign each finding to an owner with a due date — so remediation is tracked, not buried in the report
• Update the policies and procedures manual — with a version date and summary of changes
• CCO sign-off on the report — the review is complete and evidence is attached
• Senior management approval — the CEO or managing member records Approved or Not approved
• Retain the report and evidence — Rule 204-2(a)(17) requires records documenting the annual review
• Schedule next year’s review and the interim testing calendar — quarterly code of ethics checks, marketing sampling and billing tests