Why effective annual reviews require more than compliance ownership

‍

When the SEC publishes examination observations, most firms immediately consider the practical implications. What deficiencies were identified? Which policies may need to be updated? What steps could preventsimilar findings?

Those are important considerations, but they can direct attention toward individual requirements rather than the broader organizationallessons behind them.

The SEC's recent observations regarding investment adviser annual compliance reviews provide a useful example. Rather than focusing on the individual deficienciesidentified in the Risk Alert, it may be more useful to address the broader tendencyof firms to drift away from the practices they intended to follow, whether policiesare addressing proxy voting, fee disclosures, the marketing rule, or any otherwritten policy (e.g. GIPS Policies & Procedures) and ask the question: How can firms keep policies,procedures and practices aligned as the business evolves?

‍

The Real Purpose of an Annual Review

For more than twenty years, SEC-registered investment advisers have been required to conduct annual reviews assessing the adequacy of their compliance policies and procedures and the effectiveness of their implementation. Despite that purpose, an annual review can become a routine exercise, particularly when it is left solely to the compliance department. A firm completes its testing, documents the findings, produces a report, and moves on to other priorities. The review may be finished on schedule withoutyielding meaningful insight into the compliance program.

A more effective approach uses the process to assess how well the firm’s written framework supports its current operations. The goal is not merely to demonstrate that policies exist or that testing occurred, but to determine if the compliance program remains appropriately designed and effectively implemented.

When performed thoughtfully, the review can identify emerging risks, unresolved concerns, and changes that have not yet been incorporated into the firm’s documentation. A review that identifiesopportunities for improvement can be more valuable than one designed primarilyto confirm that everything is working as expected.

Rather than just asking people to read, understand, and sign the firm’s policy documents, compliance can getcurious and ask the entire team subject to the policy to review not just forunderstanding but to evaluate for:

• The continued relevance of existing policies?
• The consistency between documented procedures and actual execution?
• The effect of business changes on reporting, disclosures, risk exposures, and operating practices?

Established firms with compliance staff or outsourced compliance consultants rarely experience significant governance failures because a policy is missing. More often, challenges emerge when business practices evolve while theframework designed to oversee them remains unchanged.

From a GIPS perspective, these disconnects often appear in subtle ways. Composite maintenance procedures may still reference reports, systems, or workflows that were replaced years ago. Benchmark selectionprocedures may no longer reflect how benchmark decisions are actually made.Committee responsibilities may have gradually shifted without correspondingupdates to the policies and procedures. Composite descriptions, disclosures, ormarketing narratives may evolve over time while the supporting documentationremains unchanged.

Understanding how that disconnect develops, and why it often goes unnoticed, may be more valuable than any individual observation containedin the SEC's recent Risk Alert.

‍

No Single Department Sees the Whole Picture

The challenge, of course, is that these disconnects are rarely visible from within a single department.

Compliance may coordinate the annual review, but it cannot independently validate every operating practice, disclosure, data source, or business development.

Performance teams understand reporting methodologies. Marketing influences how information is communicated and interpreted. Operations teams often have the clearest view of systems, workflows, and controls. Leadership determines whether concerns receive attention and corrective actions receive support.

Cross-functional participation should therefore be intentional. Before an annual review or committee meeting, relevant personnel can be asked to revisit the policies and procedures applicable to their work and consider how well those documents reflect current practice.

Compliance professionals do not need every department to become compliance experts. Instead, they should encourage colleagues to evaluate whether documentation continues to reflect reality. Useful questions include:

• If you were writing this procedure today, would it look the same?
• Are there any steps we no longer perform or perform differently?
• Is there anything in our policies, procedures, or disclosures that would surprise someone performing this work today?
• What has changed in your area during the last year that should be reflected in our governance framework?

These observations should be encouraged rather than treated as evidence that the program has failed. In many cases, they represent exactly the type of engagement and honest assessment that annual reviews are intendedto produce.

Firms can reinforce this behavior by recognizing employees who identify meaningful improvements, raise thoughtful questions, or uncover disconnects between documentation and practice. Recognition might be as simpleas highlighting substantive contributions during committee meetings, incorporating governance participation into annual objectives, or usinginformal recognition programs to acknowledge employees who help strengthen thefirm's governance framework.

No single department has a complete view of every decision, process, and control. Bringing different perspectives together gives the organization a better opportunity to identify gaps before they becomeentrenched.

‍

Delegating Ownership of the Annual Review

One of the most effective ways to strengthen an annual review is for Compliance to delegate ownership of specific review areas to the teams closest to the underlying activity.

For example, Compliance might ask the Performance team to review sections of the firm's policies and procedures that relate directly to their responsibilities, including:

• Composite construction and maintenance procedures.
• Benchmark selection and benchmark change procedures.
• Composite descriptions and performance-related disclosures.
• Trade error policies and escalation procedures.
• Performance calculation and reconciliation processes.
• Corrective actions arising from prior annual reviews, verification findings, or internal reviews.

Delegating ownership does more than distribute work. It brings subject-matter expertise into the review process and increases the likelihood that policies, procedures, and disclosures continue toreflect how the organization actually operates.

Better Governance Through Shared Ownership

The SEC's annual review observations offer a useful reminder that effective governance depends on more than policies, procedures, and testing. It requires ongoing participation from the people closest to the workand a willingness to revisit assumptions as organizations evolve.

One of the clearest lessons is that meaningful participation often produces better outcomes than compliance-only ownership. By delegating portions of the review process to the teams responsible for the underlying activities, firms can improve engagement,maintain more current documentation, and reduce the burden on Compliance toindependently validate activities it does not perform itself. The principlesthat support strong governance remain remarkably consistent: engage the peopleclosest to the work, encourage thoughtful participation, and regularly revisitassumptions as organizations evolve.

At Cascade Compliance, our senior leadership team has more than 60 years of combined experience working with the GIPS standards, SEC regulations applicable to performance reporting, and governance-related challenges. We have worked with hundreds of firms throughout the United States and abroad, helping organizations strengthen reporting processes, improve oversight practices, and navigate evolving industry expectations. If you are evaluating governance practices, refining performance reporting processes, or looking to strengthen your annual review process, we would be happy to be a resource. Contact us at connect@cascadecompliance.com.

‍