What an SEC Request List Really Tests: Can Your RIA Produce the Evidence?

The compliance team finds the requested report almost immediately. It is in the right folder, covers the correct quarter, and shows that the review was completed. Then someone asks for the records supporting its conclusion. The account sample is in a former employee’s spreadsheet. The exceptions were discussed by email. Operations made the corrections, but the report does not identify which accounts were affected or where the results were verified.

Nothing about this situation necessarily means the review failed to occur. It does mean that the firm has more work to do before it can explain what the review established. Under examination pressure, that distinction becomes consequential. The team must locate supporting records, reconcile explanations, and determine whether its original conclusion remains supportable.

For a growing RIA, responding to an SEC request list can expose the distance between recording that compliance work was completed and preserving enough evidence to evaluate that work. A dashboard may accurately report completion while saying little about the scope of a review, the information considered, or the basis for a decision. When the person who performed the work is unavailable, those omissions become harder to resolve.

The management question is straightforward: could a qualified person understand the firm’s compliance work from the records it maintains? Answering that question requires looking beyond whether documents can be retrieved. It requires examining what those documents actually demonstrate.

A request for records is also an opportunity to test a conclusion

The SEC’s published sample initial request for investment advisers reaches beyond policies and procedures. It includes testing records, compliance exceptions, annual and interim reviews, and information that enables examination staff to conduct its own testing. The accompanying risk alert explains that requests vary with the firm’s business and the examination’s scope. The sample is a preparation resource, rather than a universal list of requirements for every adviser. SEC risk alert on examination scoping and document requests

That breadth matters because a reviewer can approach the same process from several directions. A written procedure describes how the firm expects a control to operate. A completed review records what the reviewer concluded. The underlying activity provides a way to assess whether that conclusion was justified.

Consider a quarterly review that states, “No material exceptions identified.” The statement may be accurate, but its usefulness depends on what was examined. Did the review cover all relevant offices? Was the sample selected from a complete population? Did the reviewer compare the activity against the applicable requirements, or simply confirm that a required field was populated?

These are practical questions about the strength of a conclusion. They do not imply that every review requires an elaborate report. A concise record can be persuasive when its scope, method, and result are clear. A lengthy report can leave the same questions unanswered if it describes the process generally without identifying what occurred.

The approved advertisement and the advertisement that was used

A hypothetical marketing review illustrates how apparently complete records can leave a critical gap. An adviser submits a presentation through the firm’s approval system. Compliance requests changes, receives a revised version, and approves it. The platform records the approval date and the reviewer’s name. On its face, the file shows a functioning approval process.

Several weeks later, the presentation appears in a prospect meeting. The file used at that meeting contains an older performance slide and a disclosure that differs from the approved version. The approval record still exists, but it does not establish that the presentation distributed to prospects was the one compliance reviewed.

The immediate task is to determine what was used, where it was distributed, and whether the differences raise a substantive concern. The broader operational question is how the firm connects approval to distribution. If employees download files, make local changes, and circulate copies outside the approval system, a record of approval may support a narrower conclusion than management assumes.

A useful record would allow a reviewer to identify the version submitted, the changes requested, the version approved, and the evidence available about subsequent use. The precise method will depend on the firm’s systems and activities. The objective is to preserve a reliable connection between the control and the conduct it is intended to govern.

This example also shows why accumulating documents is insufficient by itself. Several versions of the presentation, a completed approval ticket, and a calendar entry for the prospect meeting may all be available. Someone still needs to determine how they relate. That work becomes substantially easier when version identification and distribution records are part of the ordinary process.

What a record establishes depends on its purpose

Compliance records frequently demonstrate different things. An employee attestation records a representation. A system log records an event captured by that system. A reviewer’s workpaper records an assessment, subject to the scope and method of the review. Each can be useful, but treating them as interchangeable can overstate what the firm knows.

An employee’s confirmation that all outside business activities have been disclosed does not independently establish that no undisclosed activity exists. A completed training record does not establish that the participant later followed the procedure. A system entry marked “reviewed” may establish that someone changed a status without revealing the substance of the review.

These limitations do not make the records worthless. They help determine what additional evidence, if any, is appropriate for the risk being addressed. A firm may reasonably rely on representations for certain purposes while using other information to identify inconsistencies or determine where further inquiry is warranted.

The same discipline applies to automated systems. If a surveillance tool generates alerts only from information supplied to it, the absence of an alert needs to be understood in that context. Before drawing a broad conclusion, the firm should understand what data the tool received, which rules were operating, and whether relevant activity fell outside its coverage. Technology can make evidence easier to collect while leaving important questions about completeness unresolved.

Preserve enough context for someone else to understand the work

The most useful supporting records explain the boundaries of a review. A later reader should be able to identify the period examined, the activity included, the approach taken, and the basis for the conclusion. Where the work involved judgment, the record should preserve enough of the reasoning to make that judgment understandable.

Suppose a reviewer excludes a group of accounts from a test because another control covers them. That may be a reasonable decision. Without an explanation, however, a later reviewer may see only an incomplete sample. Similarly, a decision to accept an apparent exception may be supportable, but the rationale can disappear if it remains in a conversation rather than in the review record.

The goal is proportionate documentation. Routine work need not become a legal memorandum, and repeating the same narrative across several systems may add effort without improving understanding. Greater attention belongs where a conclusion depends on a material assumption, an exclusion, an unresolved discrepancy, or an exercise of judgment.

The SEC staff’s 2020 compliance program risk alert describes advisers that claimed to have conducted ongoing or annual reviews but could not provide evidence that a review occurred. It also identifies failures to perform actions required by firms’ written procedures. Those observations underscore why both performance and the ability to demonstrate performance deserve attention. SEC observations on investment adviser compliance programs

Historical records need historical context

An examination may concern a period when the firm used a different procedure, employed different personnel, or operated on a platform it has since replaced. Producing today’s policy or exporting the current configuration may not explain what governed the activity under review.

This problem can become more pronounced after an acquisition or system migration. The current environment may be well organized while historical approvals remain in a legacy platform. A data export may preserve the final status of an item but omit comments, attachments, or the sequence of changes that explains how it reached that status. Leadership may not discover the limitation until the old system is no longer readily accessible.

Before a migration or termination of a service, the firm should assess which records it needs to retain and whether the proposed export preserves the information necessary to use them. A file that technically exists but cannot be interpreted without unavailable software may be difficult to evaluate. The relevant retention obligations depend on the records involved; operational convenience should not determine what is preserved.

If a gap is discovered, the response should distinguish existing evidence from a later explanation. A current memorandum may accurately describe what the firm has learned, but it should not be presented as a contemporaneous record. Preserving that distinction allows the firm to explain both the historical facts it can substantiate and the limitations it has identified.

Test the evidence before packaging the response

A practical internal exercise is to select a recently completed compliance review and give its supporting records to someone qualified who did not perform the work. Ask that person to determine what was reviewed, what conclusion was reached, and whether the available evidence supports it. Initially, let the record speak for itself. Questions requiring the original reviewer’s explanation will identify where context may be missing.

Then trace a small number of examples back to the underlying activity. If the review concerned marketing, compare approved materials with evidence of their use. If it concerned employee reporting, examine how the reviewer determined who was required to report and how outstanding items were addressed. The exercise should assess the connection between the reported result and the work supporting it.

The outcome may reveal a documentation issue, a control weakness, or both. Missing notes may make otherwise sound work difficult to understand. A missing source population may prevent the firm from determining whether the review covered the intended activity. Those findings warrant different responses. Treating every gap as a filing problem can leave a substantive weakness unresolved.

During an actual examination, an index and clear file organization can help staff navigate the response. They are most useful when the underlying materials are accurate and responsive. A well-labeled folder cannot resolve uncertainty about which version was approved or whether a review included the relevant office. Questions about unclear requests or production limitations should be addressed with the examination team rather than left for the reader to infer.

Make evidence part of the work itself

The strongest improvement often occurs at the point where compliance work is performed. A review process can capture the source information, relevant decisions, and supporting attachments as the work proceeds. That approach reduces the need to reconstruct the record later and makes handoffs easier when personnel change.

For leadership, the investment is in a program that can explain its own activity. The CCO should not have to serve as the only interpreter of years of reviews, exceptions, and corrective decisions. When records preserve their context, another qualified person has a better chance of understanding what happened and identifying what remains uncertain.

My RIA Lawyer’s SEC mock examination services provide an opportunity to examine that capability through document review and staff interviews, with findings and remediation planning to address identified weaknesses. For an RIA evaluating its readiness, one completed review can be a productive place to begin.

Select a conclusion your firm relies on, locate the supporting work, and ask someone outside that process to assess it. What they can establish—and what they cannot—will tell you more about the strength of your evidence than the number of completed tasks on the compliance calendar.