The SEC examination, step by step
How an examination of an investment adviser runs, from the call that announces it to the letter that closes it. Each step starts with what the Division of Examinations says, quoted from its Exam Handbook (published 1 October 2026) or from the rule, then what to do, what to avoid, and the letters and memos to send, ready to copy.
Written for SEC-registered advisers, including private fund managers. Exempt reporting advisers are examinable too: their records are subject to examination under section 204(a) of the Advisers Act. State-registered advisers are examined by their state securities regulator, whose process differs in its details, though the preparation is the same.
The clocks
| When | What | Basis |
|---|---|---|
| Within 24 hours | Records available to the staff | The Commission's expectation "in most circumstances", per the handbook. In practice the initial request usually allows two weeks. |
| About 2 weeks | Production in response to the initial request | Handbook. A date in the letter itself governs. Supplemental requests carry their own. |
| 180 days | Disposition letter | 15 U.S.C. 78d-5(b): from the later of the end of any on-site work and receipt of all requested records. Extendable once by 180 days for certain complex exams. |
| 30 days | Your written response to a deficiency letter | Handbook: typically requested within 30 days of the letter's date. Ask for an extension as soon as you know you need one. |
| 60 days | Staff comments on your response, if any | Handbook: a target the staff "will strive" to meet, not a deadline on you. |
Before there is an exam
The staff reviews your filings and websites before the exam starts. "Keeping your filings current and accurate makes examinations more efficient and can reduce the number of findings on your exam."
Books and records are kept in an easily accessible place for five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser.
What to do
- Read your Form ADV, your website and your current pitch materials side by side. The examiners will, before they call you. Every place they disagree is a question you would rather answer now.
- Know where each category of record lives and who can pull it. The handbook's 24-hour expectation is a fair test: could you produce your trade blotter, your code of ethics reports and last year's annual review by tomorrow?
- Document the annual review under Rule 206(4)-7: what you tested, what you found, what you changed. It is requested in nearly every exam, and the Division published observations on it in September 2026.
- Name a response team now: a lead, a backup for the lead, and an owner for each record area. Decide who calls outside counsel.
- Tell your people that the staff does not consent to recording, transcription or AI notetaking tools in exam meetings. Make sure nobody's calendar auto-joins one.
- Read the current examination priorities and the risk alerts on your business lines. They are the closest thing to the questions in advance.
What to avoid
- Assuming you are not due. The program is risk-based, not a rotation, and the factors include time since registration or the last exam, a change in key personnel, and tips or complaints.
In LunaThe compliance calendar, policy library and the records each module keeps (marketing reviews, personal trading, gifts and entertainment, the MNPI register) are the records a request letter asks for, kept where they can be produced the same day.
The announcement call
"Most examinations begin with a brief call from staff to the chief compliance officer (CCO) or other regulatory contact to announce the exam." It is "an ideal time to let staff know about any other ongoing regulatory inquiries that you think may slow your responsiveness."
"The reason for a particular examination is non-public information." Being selected "is not, in itself, a signal that something is wrong."
Staff identity can be confirmed through the Examination Hotline, 202-551-EXAM or examhotline@sec.gov.
What to do
- Take names: the caller, the lead point of contact, the office or unit, and the exam team's email addresses.
- If anything about the call is unusual, verify it through the Examination Hotline, using the number published by the SEC, not one the caller gives you.
- Mention any other regulatory inquiry under way, and any known scheduling conflict (fundraising, an investment committee, key people travelling). The staff says it will try to work with you on scheduling.
- Ask how the request will arrive and how records should be transmitted, and whether an on-site visit is planned.
- Within the hour, notify the response team, under confidentiality. Most employees do not need to know yet.
What to avoid
- Pressing for the reason the firm was selected. The staff will typically not say, and the answer tells you nothing actionable.
- Agreeing to a production date on the call before you have seen the request.
Subject: Confidential: SEC examination [Names], The SEC's Division of Examinations called today to announce an examination of [firm]. The lead contact is [name], [office], [email]. This is confidential. Please do not discuss it outside this group until we agree how and when to tell others. What happens next: 1. We expect the formal letter and initial request list by [date]. I will circulate it as soon as it arrives. 2. Each request item will be assigned to one owner, with a due date ahead of the SEC's. 3. We will meet [daily / twice a week] while we are producing records. First meeting: [date, time]. Until then: please do not delete, move or edit records in your area, and do not create new documents to describe past practice. If you are unsure whether something is a record, ask me. Being selected is not, in itself, a sign that something is wrong. The SEC says so in its own handbook. [Name] Chief Compliance Officer
In LunaOpen the exam in Luna when the call ends. Its deadlines go on the compliance calendar as events with no attendees, so they remind the compliance team and stay invisible to everyone else.
The request letter
"In practice, the staff usually provides two weeks to produce records in response to the initial information request." Supplemental requests vary. "Please communicate promptly to the staff any questions or concerns regarding the information that has been requested."
"The staff will grant requests for reasonable extensions of time or rolling productions, where appropriate."
What to do
- Break the letter into its items and sub-items, word for word, and give each one owner and an internal due date a few days ahead of the SEC's.
- Read every item for scope before anyone starts collecting: which entities and accounts, which period, which format.
- Where an item is unclear, ask the lead examiner before compiling, then confirm what was agreed in a short email. An understanding that lives only in a phone call is one nobody can check later.
- Ask for an extension or a rolling production early, in writing, with the items affected, the reason and a proposed date. Readily available records (the compliance manual, financial statements) are not the place to ask.
- Answer every item. If one does not apply, say so and why.
What to avoid
- Producing to your own reading of an oral request. Ask for it in writing, or confirm it in writing yourself.
- Letting the clock run while an item is unclear.
Subject: [Firm] examination: request item [number] clarified Dear [Examiner], Thank you for your time today. To confirm our understanding of request item [number]: - Scope: [entities / accounts / funds] for [period]. - Format: [native files / system export with fields X, Y, Z / sample of N]. - [Anything excluded, and why.] Unless you tell us otherwise, we will produce on that basis by [date]. [Name] [Title], [Firm]
Subject: [Firm] examination: proposed production schedule Dear [Examiner], We are working through the initial request list and expect to produce most items by [date in the letter]. For the items below, we propose a later date or a rolling production: Item [number]: [what it is]. [Reason: volume / third-party data / privilege review / older records in archive]. Proposed date: [date]. Item [number]: ... Everything else will be produced by [date]. Please let us know if this works, or if a different order would help the staff. [Name] [Title], [Firm]
In LunaUpload the request letter and Luna splits it into its numbered items, cutting each item's text from the letter itself rather than paraphrasing it. An item it cannot locate in the letter is marked for a person to check. Each item gets an owner, a status (open, in progress, produced, or not applicable with the reason), comments and documents, and a pointer to where Luna already holds matching records.
Producing records
If you withhold or redact anything as privileged, provide a privilege log identifying: who created the document; everyone who received it or was informed of its substance; its date; a brief description; the specific privilege claimed; and the request it relates to.
Rule 83 lets you ask that records you submit be withheld if someone requests them under FOIA. Each page or segregable portion must be marked "Confidential Treatment Requested by [name]" with an identifying number and code, and a copy of the written request (not the records) goes by mail to the SEC's FOIA office.
The staff "generally does not return records produced during an examination", and when it uses a firm's or a service provider's system holding the firm's records it "does not agree to any related terms or conditions".
What to do
- Follow the Division's Data Delivery Guidance for file formats and labelling, and test the SEC's secure transfer before the deadline, not on it.
- Send each production with a short cover memo: what is included, how you read the request, what is excluded and why, and which items are not applicable.
- Before anything goes out, check it against Form ADV, the offering documents and what you have already produced. Inconsistency between documents is a reliable way to widen an exam.
- Keep an exact copy of every production, numbered, with the date it was sent.
- Consider Rule 83 treatment for sensitive commercial material, with counsel, before you produce rather than after.
What to avoid
- Creating documents now to describe past practice and producing them as if they were contemporaneous. If a process was not written down, say so and describe it.
- Producing a vast volume with no framing when a short call would narrow the request.
[Firm]: Production [number], [date] In response to the request dated [date], items [numbers] Produced Item [number]: [file names or Bates range]. [One line on what it is.] Item [number]: ... How we read the request Item [number]: [scope, period or format we used, and the date we confirmed it with the staff, if we did]. Not applicable Item [number]: [why it does not apply to the firm]. Withheld or redacted [None.] / [See the privilege log produced with this production.] To follow Item [number]: expected [date], as agreed on [date].
Confidential Treatment Requested by [Firm name] [Identifying number and code, e.g. FIRM-EXAM-000001]
In LunaLuna gives you a privilege log spreadsheet with the handbook's columns, and exports the full item list with owners, statuses and dates. Outside counsel can be invited as a guest who sees that exam and nothing else, and the CCO can revoke the access.
Interviews and on-site visits
The staff may begin with an initial interview of the CCO "to better understand your company and its operations and to inform the examination's scope". Basic or fundamental questions are "meant to establish a shared understanding of your business."
"The staff does not record or transcribe meetings and instructs participants not to do so either. The staff does not consent to the use of recording, transcription, artificial intelligence notetaking tools, or other similar technologies."
Some exam teams, the Private Funds Unit among them, ask for an opening presentation on the firm: its business, structure, funds or clients, fees and expenses, conflicts and compliance program.
What to do
- Prepare each interviewee on three things: the policies they own, what has been produced that concerns their area, and the examination period.
- Put the right person in the room. If the staff asks for someone who is not the best person for a topic, propose who is.
- Answer the question asked, from what you know. "I don't know, I'll find out and come back to you" is a complete answer.
- Keep the answers inside the examination period unless asked about another.
- Have the CCO attend, and take notes by hand or typed by a person. Write down every follow-up promised, and who owns it.
- On video, cameras on. On site, a private room, and nothing sensitive discussed within earshot.
- If the staff seems to have misunderstood a policy or practice, say so then. The handbook asks you to.
What to avoid
- Guessing, speculating, or filling a silence.
- Answers that differ from the documents already produced, or from what a colleague said yesterday.
- An opening presentation written as marketing. It is read as a risk assessment, and it should match Form ADV line for line.
Staff analysis and the dialogue in between
"You are encouraged to keep the staff informed of any relevant changes, including any actions that have been or will be taken to address issues discussed with the staff."
"While not dispositive, prompt and appropriate action to correct findings of potential violations may be a mitigating factor in considering whether we will refer an exam finding to the Division of Enforcement."
What to do
- Ask for status when you need it. The handbook invites it.
- When something is plainly broken, start fixing it now, keep the evidence, and tell the staff in writing.
- Keep one list of everything still open: items, follow-ups promised in interviews, questions the staff has raised.
What to avoid
- Waiting for the deficiency letter to begin remediation you already know is needed.
The exit conference
The staff "typically conducts an exit conference to discuss issues identified during the examination, if any", and typically requests that "members of your senior management or board of directors attend".
"If you believe something is inaccurate or if there is additional information we should consider, please let us know during the conference."
What to do
- Bring senior management, as asked.
- Correct factual errors on the spot, with the document that shows it if you have it.
- Describe what you have already done and what you plan to do.
- Write down every issue raised, including any the staff mentions only orally. Oral feedback is one of the ways the staff addresses noncompliance, and the next exam team may ask what you did about it.
What to avoid
- Arguing the merits of each finding. Facts can be corrected in the room; legal disagreement belongs in the written response.
The disposition letter
The letter says the exam has concluded, has concluded without findings, or that the staff requests corrective action: a deficiency letter. "Most examinations conclude with such a letter."
"If a deficiency or other disposition letter does not address a particular activity, that does not mean that the activity complies with the federal securities laws." None of the outcomes forecloses enforcement action.
What to do
- Calendar the response date the day the letter arrives, and ask for an extension at once if you will need one.
- Give each finding one owner and decide early which, if any, you will contest.
- Bring in counsel where a finding implicates client or investor money, disclosures, or anything that could reach Enforcement.
Your response
A deficiency letter asks you "to respond in writing to the findings and indicate any steps that have been or will be taken to address the issues and prevent their recurrence", typically within 30 days.
Deficiency letters "purposely do not mandate a particular corrective action beyond complying with applicable law."
What to do
- Answer each finding in the letter's own order and words.
- Get the facts agreed first. Disagree on the law, if you must, separately and with the document or disclosure you rely on.
- Separate what is done (with evidence attached) from what is planned (with an owner and a date). Completed work persuades; promises are checked.
- Say why it happened and why it will not happen again: the handbook asks how you will prevent recurrence, not only how you fixed this instance.
- Promise only what you will keep doing. Each commitment in the response is something the next exam team can ask you to prove.
What to avoid
- A defensive or litigious tone.
- Vague commitments ("enhanced monitoring") that cannot be evidenced later.
Finding [number]: [quote the finding's heading or first sentence] 1. The facts [What happened, briefly. If the letter misstates a fact, correct it here and cite the document.] 2. Our position [We agree. / We agree in part: ... / We respectfully disagree, because [governing document, disclosure or rule, quoted]. We have nonetheless ...] 3. What we have done [Action], completed [date]. Evidence: Exhibit [letter] ([revised policy / training record / reimbursement calculation and proof of payment / investor notice]). 4. What we will do [Action]. Owner: [title]. Complete by: [date]. 5. Why it happened, and why it will not recur [Root cause.] [The control that now prevents it, who runs it, how often, and where its evidence is kept.]
Staff comments, closing, and after
If the staff has comments on your response it will "strive to provide them within 60 days". "The absence of any comment by the staff on the firm's response should not be interpreted as concurrence." To confirm an exam is closed, ask the exam team.
What to do
- Track every commitment in the response to completion, with evidence, and report progress to senior management.
- Fold each finding into the next annual review as something to test, not only something to re-read.
- Keep the whole exam file together (requests, productions, correspondence, notes, response) for the next one.
What to avoid
- Reading silence as approval, or as a sign of trouble. It is usually neither.
Finding | Commitment, in the response's words | Owner | Due | Status | Completed on | Evidence (file and location) | Tested in annual review (year, result)
Running the exam in Luna
Luna's SEC Exams page follows the handbook's roadmap from announcement to closing. It is open only to the compliance team, because that an exam is under way is itself confidential.
- Upload the request letter and get its items in the letter's own words, with anything Luna could not locate marked for a person to check.
- One owner, status and due date per item, with "not applicable" requiring a reason, plus comments and documents on each item.
- The handbook's deadlines worked out from the dates you record and kept on the compliance calendar with reminders, visible only to compliance.
- Pointers from request items to records Luna already keeps: policies, the marketing exam package, personal trading, gifts and entertainment, outside activities, the MNPI register.
- A privilege log in the handbook's format, and an export of every item with its owner, status and dates.
- Guest access for outside counsel, limited to the one exam and revocable by the CCO.
Sources
- The SEC Exam Handbook (Form 2389, October 2026)
- Examination priorities, fiscal year 2026
- Risk Alert: annual compliance review observations (September 2026)
- 15 U.S.C. 78d-5(b); Advisers Act section 204(a); Rules 204-2 and 206(4)-7; 17 CFR 200.83 (Rule 83)
- Division of Examinations Data Delivery Guidance
Current as of October 2026. A practical guide, not legal advice; every exam is different, and where a finding could reach clients' money, disclosures or Enforcement, involve counsel. The handbook itself is staff guidance with no legal force, as it says.