Compliance testing for investment advisers

Compliance testing is the work an adviser does to show that its written policies were actually followed and actually worked: taking a defined set of records, checking them against what the policy requires, and recording what was found. Rule 206(4)-7(b) requires an SEC-registered adviser to review the effectiveness of the implementation of its policies at least annually, and testing is how a firm produces the evidence for that half of the review.

This guide is about the testing itself: how to design a test, the main kinds of test, how to choose a sample, how to write up results and exceptions, and how to track the fixes. For what the annual review as a whole must consider, see the annual compliance review checklist.

Where testing comes from

The rule does not use the word "test." It requires written policies and procedures reasonably designed to prevent breaches of the Advisers Act (paragraph (a)) and an annual review of their adequacy and the effectiveness of their implementation (paragraph (b)).

The adopting release, Release IA-2204 of December 2003 (68 FR 74714), fills in the expectation. It says an adviser's policies and procedures should be designed to prevent breaches from occurring, detect those that have occurred, and correct them promptly (68 FR 74716). In a footnote to that passage it adds that, where appropriate, policies "should employ, among other methods of detection, compliance tests that analyze information over time in order to identify unusual patterns." Its examples are an analysis of the quality of brokerage executions to evaluate best execution, an analysis of portfolio turnover to see whether portfolio managers are overtrading, and an analysis of the comparative performance of similarly managed accounts to detect favoritism or misallocation.

The release also says advisers should consider interim reviews in response to significant compliance events, changes in business arrangements and regulatory developments (68 FR 74720). Testing spread through the year is the usual way firms act on that.

What examiners have said about testing

The Division of Examinations' Risk Alert of 14 September 2026, Examinations Observations Regarding Investment Adviser Annual Compliance Review, describes several findings that are really about testing. The staff saw compliance policies that required "testing and validation" but gave no direction on how to test, what factors to weigh in judging the results, or what documentation to keep. It saw policies that said a topic, identity theft in its example, must be tested annually, where the review then left the topic out. It saw reviews that did not use the workpapers or perform the tests the firm's own procedures specified, reviews that tested superseded versions of policies, and testing records that were made and then not kept. The Risk Alert is a staff statement, not a rule, but it shows what an examiner will compare your testing against: your own written procedures.

Controls, monitoring and testing are different things

It helps to separate three activities that are often blurred.

• Controls are the steps that happen as business is done: preclearing a personal trade, approving an advertisement before it is used, reviewing a fee calculation before billing.
• Monitoring is ongoing surveillance by compliance, such as a daily restricted list check or email review.
• Testing looks back over a period and asks whether the controls and monitoring operated as the policy says, and whether they caught what they were meant to catch.

Testing does not replace controls. A firm that tests fee billing once a year still needs someone to check invoices before they go out. What testing adds is independent evidence, after the fact, that the control ran.

Kinds of tests

The terms below are industry usage, not defined terms in any rule. Firms use them to plan coverage.

Transactional testing

A transactional test takes individual items and checks each one against the policy. Examples include pulling a sample of client invoices and recomputing each fee from the advisory agreement and Form ADV, or taking a sample of advertisements and checking each one for pre-use approval and the substantiation the firm's marketing policy requires. Transactional tests answer the question "was this item handled correctly?" and produce a clear exception for each item that was not.

Forensic or pattern testing

A forensic test looks across a whole data set for patterns that individual items would not reveal. This is the kind of test the adopting release describes. Comparing the performance of accounts that follow the same strategy can surface allocation favoritism. Comparing employees' personal trades with client trades in the days around them can surface front-running. Measuring turnover by account can surface overtrading. Forensic tests usually produce questions rather than conclusions, and each outlier has to be followed up and explained.

Periodic and forward testing

Periodic testing means running tests on a schedule through the year (monthly, quarterly, semi-annually) rather than all at once in the month before the annual review. Some firms call the schedule a forward testing plan, because it is set at the start of the year and looks forward. It spreads the work, finds problems while they are still small, and gives the annual review a year of results to draw on.

Interim and targeted testing

An interim or targeted test responds to an event: a new custodian, a new strategy, a complaint, an error, a regulatory change, a departing portfolio manager. It sits outside the schedule and is often narrower and deeper.

Designing a test

A test that someone else could pick up and repeat has the same parts every time. Writing them down before testing begins is what answers the Risk Alert's finding about procedures that said "test" without saying how.

1. Objective. The policy or rule requirement being tested, stated specifically. "Fees were charged in line with each client's agreement and Form ADV, including breakpoints and proration" is testable. "Review billing" is not.
2. Risk. Why this matters at this firm. The adopting release asks advisers to start from the conflicts and compliance factors in their own operations, and a test plan built from the firm's risk inventory will test different things at a firm with private funds than at one that manages separate accounts.
3. Population. The complete set of items the test could draw from, with its source and the period it covers. Most testing failures start here: a sample drawn from an incomplete population can pass every item and still miss the problem.
4. Method. Transactional, forensic or both, and the sample design.
5. Steps. What the tester does with each item, in order, and what evidence to look at.
6. Criteria. What counts as an exception, and what counts as an observation that is worth noting but not an exception.
7. Evidence. What is kept: the population, the sample, the items examined and the tester's notes.
8. Owner and timing. Who runs it, who reviews it, and when.

Testing the right version of the policy

The Risk Alert describes reviews that assessed policies already superseded before the review period began. Each test should identify the version of the policy in force during the period tested. Rule 204-2(a)(17)(i) requires the firm to keep each version of its compliance policies in effect at any time in the past five years, so the version should be available.

Sampling

No rule or SEC release sets a sample size for adviser compliance testing. What follows is common practice, and the right answer depends on the size of the population and the risk.

• Test the whole population when it is small or high risk. If a firm has a dozen advertisements in a year, or a few accounts subject to the custody surprise examination, review all of them.
• Use a random sample for large, uniform populations. Thousands of invoices or trades of the same kind suit random selection. Recording how the sample was drawn, including any random seed, lets a reviewer or an examiner draw the same sample again.
• Add judgmental selections for known risk. Accounts with large deposits during a billing period, new clients, terminated clients and accounts on non-standard fee schedules are where billing errors cluster. The Risk Alert's billing examples (different calculation methods, no proration for large deposits, missed breakpoints, no refunds on termination) suggest where to look.
• Expand when you find exceptions. One exception in a sample may be isolated. Several suggest a pattern, and the usual response is to widen the sample or test the whole population for that issue.

Whatever method is used, state it in the workpaper and keep the population the sample came from. A sample cannot be judged without knowing what it was drawn from.

Documenting results

Each completed test should produce a record that shows what was done and what was found. A workable record contains:

• the test's objective, policy reference and period
• the population, its source and the sample drawn
• the steps performed and the evidence examined for each item
• each exception, with enough detail to understand it without the tester
• a conclusion, for example no exceptions, exceptions noted, or an observation
• who performed the test, who reviewed it, and the dates

Under Rule 204-2(a)(17)(ii), any records documenting the annual review must be kept, and under Rule 204-2(e)(1) they are kept for at least five years from the end of the fiscal year of the last entry, the first two years in an appropriate office. Testing workpapers that support the review fall within that. The Risk Alert's documentation findings include firms whose written reports discussed issues found in testing while the testing records themselves were not kept.

Exceptions and observations

Not every finding is the same. An exception is a departure from what the policy requires: a fee charged at the wrong rate, a trade not precleared, an advertisement used without approval. An observation is something worth recording that is not a departure: a procedure that worked but relies on one person, or a policy that is followed but no longer describes current practice. Recording observations matters because an out-of-date policy is an adequacy problem for the annual review even when nobody broke it.

For each exception, record the root cause where it can be found. A wrong fee caused by a data entry error is fixed differently from one caused by a billing system that cannot prorate.

Known incidents belong in the record

The Risk Alert notes reviews that did not record breaches already identified and reported during the review period. Breaches found outside testing, from complaints, trade errors or an employee's report, should be logged in the same place as testing exceptions, so the year's picture is complete.

Remediation tracking

A finding is not closed when it is written down. Each one needs:

1. An owner responsible for the fix, who is not necessarily in compliance.
2. A corrective action that addresses the root cause, which may be a client refund, a policy change, a system change, training or discipline.
3. A due date set by the risk of the finding.
4. Evidence that the fix was made, such as the refund record, the revised policy or the changed system setting.
5. Verification, ideally a retest, before the finding is closed.

The Risk Alert's last group of observations is about this step. The staff saw recommendations from one year's review that were never implemented, including cases where the review report said corrective action had been taken and the same issues persisted. Retesting a sample after a fix is the plain way to show that a fix worked.

Feeding the annual review

When testing runs through the year, the annual review draws on it rather than starting from nothing. The year's test results show effectiveness of implementation area by area. Exceptions, observations and remediation status show where policies need to change, which is the adequacy question. Areas with repeated exceptions are candidates for more frequent testing next year, and areas with clean results over several years may be tested less often, with the reasoning recorded.

The annual review covers more than test results: changes in the business, changes in the law and compliance matters from the year all come in too. The annual compliance review checklist sets out those inputs and the areas the adopting release expects policies to cover.

Common questions

Is compliance testing required for RIAs?

Rule 206(4)-7 does not use the word, but it requires an annual review of the effectiveness of the implementation of the firm's policies, and the adopting release expects policies to include compliance tests where appropriate. In practice, an examiner who asks how the firm knows its policies were followed expects to see testing.

How often should compliance tests be run?

No rule sets a frequency for individual tests. Many firms test higher-risk areas such as fee billing, personal trading and marketing quarterly or semi-annually, and lower-risk areas annually. Whatever the plan says, the firm should follow it, because the Risk Alert compares reviews with the firm's own procedures.

What is the difference between transactional and forensic testing?

Transactional testing checks individual items against the policy, such as recomputing a sample of invoices. Forensic testing analyzes a whole data set for patterns, such as comparing the performance of similarly managed accounts. The adopting release describes the second kind as tests that analyze information over time to identify unusual patterns.

How large should a compliance testing sample be?

The SEC has not set a sample size for adviser compliance testing. Firms usually test small or high-risk populations in full, sample large uniform populations at random with some risk-based selections added, and widen the sample when exceptions appear. The method and the population should be recorded.

Can annual attestations replace compliance testing?

No. The Risk Alert identifies firms that treated training or annual attestations as satisfying the annual review requirement. An attestation is a control that testing can check; it is not evidence that policies were followed.

Who should perform compliance testing?

The rule does not say. The chief compliance officer usually owns the test plan, and testing may be done by compliance staff, others in the firm who are independent of the activity tested, or an outside consultant. A person should not test their own work.

Run the tests where the records are

Luna's annual review testing lets a firm choose tests and set when each one runs, draws reproducible samples from records already in Luna, keeps the evidence with each result, and tracks each finding to a verified fix before it rolls into the annual report the CCO signs. The compliance calendar puts the testing schedule on dates, and the compliance manual template includes an annual review procedure. For the role that owns the program, see chief compliance officer duties.