Your CCO Just Quit. Would Your Compliance Program Survive?

The SEC’s Latest Risk Alert Exposes a Management Problem That Many Investment Advisers May Not Realize They Have

It’s Friday afternoon, and the CEO of a midsize registered investment adviser is getting ready to log off for the weekend when his phone rings. It’s his Chief Compliance Officer.

Uh oh, he thinks. I only hear from her when something is wrong. Come to think of it, it’s been a while since we last spoke. I hope she’s not asking for more staff again.

He answers the phone.

“Hey, I wanted to let you know I’ve accepted an offer from another firm. My last day will be two weeks from today.”

Well, that’s certainly not how he wanted to end his week.

His immediate thoughts turn to finding a replacement. This is the fourth CCO in two years! Experienced compliance professionals aren’t easy to find, and two weeks isn’t much time. He’ll need to call the recruiter on Monday. In the meantime, perhaps someone in operations can help cover the department’s responsibilities.

Then another question occurs to him: What exactly does she do all day?

He knows she reviews marketing materials, sends out quarterly code of ethics certifications (ugh  homework!), handles employee registrations, and occasionally sends emails about regulatory developments. The boring stuff he hates. But what about the rest of the compliance program? When was the last annual compliance review completed? Where are the testing records? Are there outstanding issues that need to be addressed?

He realizes he doesn’t know the answers. And with his CCO leaving in two weeks, he’s about to find out how much of the firm’s compliance program depends on one person.

For owners of registered investment advisers, this scenario illustrates a business risk that deserves considerably more attention, particularly following the SEC’s latest Risk Alert concerning annual compliance reviews.

The Compliance Obligation That Can Go Missing Without Anyone Noticing

On September 14, 2026, the SEC’s Division of Examinations published a Risk Alert, Examinations Observations Regarding Investment Adviser Annual Compliance Reviews, identifying deficiencies in how investment advisers conduct, document, and follow up on their annual compliance reviews under Rule 206(4)-7 of the Investment Advisers Act of 1940.

Several law firms and compliance consulting organizations have published helpful summaries of the Alert, detailing the SEC’s findings and offering recommendations for improving annual review procedures.

But there is a larger management issue underlying those findings that deserves attention.

The annual compliance review is the investment adviser’s responsibility, not simply the CCO’s responsibility.

Consider how most investment advisers approach their annual Form ADV amendment. There is a filing deadline, usually accompanied by calendar reminders, automated emails from the SEC and emails, and established procedures designed to ensure the filing gets completed. Business owners generally understand that failing to maintain the firm’s registration can have serious consequences.

The annual compliance review is different. Although Rule 206(4)-7 requires SEC-registered advisers to review their compliance policies and procedures no less frequently than annually, there is no corresponding annual filing with the SEC confirming that the review was completed. There are no automatic reminder emails from the SEC, and a missed review doesn’t necessarily create an immediate disruption to the business.

A firm can miss its annual review and continue operating normally. It can miss another. Clients continue receiving advice, employees continue servicing accounts, and the business continues generating revenue.

And then the acting CCO gets a phone call from their friendly SEC examiner. Uh oh.

Annual compliance reviews are always requested during SEC examinations.

Imagine being a business owner who learns during an examination that the firm hasn’t completed a required review in two years, or that the reviews were supposedly completed but nobody can locate the supporting documentation. 

The problem is no longer confined to the annual review itself. Examination staff now have reason to question whether the firm’s broader compliance program is functioning effectively. We might have a culture of compliance problem here – time to dig a little deeper!

The SEC’s September Risk Alert specifically identifies advisers that missed annual reviews, conducted reviews covering periods longer than 12 months, or failed to correct deficiencies identified during previous examinations. Some firms continued missing reviews even after receiving deficiency letters from the SEC.

Depending on the circumstances, those deficiencies could contribute to more significant regulatory scrutiny, including potential enforcement action.

That raises a legitimate question for business owners: How does something this important go unnoticed by the people responsible for running the firm?

The Compliance Department Nobody Really Understands

Many small and midsize investment advisory firms operate with relatively lean compliance departments. Some have a full-time CCO supported by one or two compliance professionals. Others have a CCO who also serves as Chief Operating Officer, General Counsel, or another senior executive. These arrangements are not inherently problematic, but limited staffing creates operational vulnerabilities that business owners sometimes underestimate.

Consider how most employees interact with compliance. An adviser submits a marketing piece for approval. Compliance reviews it. Someone needs a Form U4 amendment. Compliance handles it. A new adviser joins the firm. Compliance coordinates the registration requirements.

These are visible activities. They generate emails, requests, approvals, and completed tasks. If they don’t get done (or get done slowly), someone at the firm notices.

But much of the work necessary to maintain an effective compliance program happens outside those interactions. Someone needs to evaluate whether policies reflect current business practices and then update the compliance manual, monitor regulatory developments, document compliance testing, and track corrective actions.

And then someone needs to bring that information together for the annual compliance review.

How much of that work is visible to the firm’s owners?

In many advisory businesses, the CCO is not routinely included in executive management discussions. Compliance may report directly to the CEO, but that doesn’t necessarily translate into regular conversations about the department’s activities, priorities, resource constraints, or outstanding issues.

The CCO is expected to manage compliance. Management assumes compliance is being managed. Unless something goes wrong, the arrangement continues.

That may be convenient, but it also creates a significant operational risk.

Your Compliance Program May Have a Key Person Problem

Anyone who has managed a business or department understands how difficult employee turnover can be. An experienced employee leaves, and suddenly the organization discovers how much institutional knowledge existed only in that person’s head.

Where are the files? Who maintains that spreadsheet? Which projects were completed? Which ones were still in progress? Who was supposed to follow up?

Now imagine that the departing employee was responsible for administering the firm’s compliance program.

Perhaps that person developed the annual compliance review methodology, maintained testing schedules, documented compliance findings, and tracked remediation efforts. Perhaps they knew which policies were outdated, which operational practices had changed, and which employees needed additional training.

But much of that information was stored in personal folders, individual spreadsheets, or email correspondence. Maybe it was even on the employee’s desktop. Some of it may never have been formally documented.

When that employee leaves, the firm may retain its compliance manual and regulatory filings, but much of the institutional knowledge necessary to administer the program may leave with them.

This is classic key person risk, and it can be particularly acute when one individual is responsible for most compliance functions.

The SEC’s Risk Alert specifically identifies CCO departures and other personnel changes among the circumstances associated with advisers conducting annual reviews outside the required timeframe.

The SEC is reminding advisers that employee turnover does not suspend the firm’s regulatory obligations. The annual review still needs to happen, the documentation still needs to exist, and previously identified deficiencies still need to be addressed.

What If Your Compliance Team Quiet Quit?

There is another dimension to this problem that deserves attention.

Compliance professionals work in an environment where regulatory expectations are substantial, requirements are complex, and resources are often limited. At smaller firms, much of that responsibility may fall on one person.

It’s not surprising that compliance officer burnout has become a recurring topic in industry discussions. Articles such as Survey: Compliance Officers Stressed, Anxious, Burned Out reflect concerns about the pressures facing compliance professionals.

Burnout doesn’t always result in someone resigning. Sometimes employees simply disengage. They continue showing up, answering emails, and completing the most visible tasks, but the work requiring initiative, judgment, and sustained attention may begin to suffer.

That possibility creates a difficult management challenge in compliance.

A marketing approval that doesn’t get completed is usually noticed. A registration filing that doesn’t get submitted may generate questions. But what happens when compliance testing quietly stops? What happens when previously identified deficiencies aren’t followed up on, or when the annual review becomes little more than a recycled document from the previous year?

Those failures may not produce immediate consequences. They may remain invisible until an SEC examination reveals them.

To be clear, burnout does not necessarily lead to disengagement, and many compliance professionals continue performing demanding work under difficult circumstances. But business owners should recognize that an understaffed, overworked compliance department can create risks that are difficult to observe from outside the department.

If your compliance team quiet quit, would you even know?

Not whether they stopped responding to emails or whether marketing approvals were taking longer. Would you know if the substantive work necessary to maintain an effective compliance program had stopped getting done?

Your CCO Shouldn’t Be Operating on an Island

The SEC’s Risk Alert identifies several deficiencies that illustrate why compliance cannot operate effectively in isolation.

Examination staff observed annual reviews that failed to identify discrepancies between written policies and actual business practices. Examples included advisory fee calculations that differed from client disclosures, outdated marketing policies, incomplete custody procedures, and inadequate oversight of delegated responsibilities.

The staff also identified firms whose annual reviews failed to account for changes in business activities that affected the adequacy of their compliance programs.

Consider what that means operationally. A CCO cannot evaluate whether the firm’s compliance policies adequately address its business activities without understanding those activities.

If ownership establishes a new affiliate relationship, someone needs to inform compliance. If operations changes how advisory fees are calculated, compliance needs to know. And if the firm begins offering new services or enters new referral arrangements, those developments may affect the compliance program.

And if compliance identifies deficiencies requiring changes to business practices, management may need to authorize resources or direct other departments to implement those changes.

None of this works particularly well when compliance operates as a separate administrative function with limited access to executive leadership.

Compliance needs information from the business, and the business needs information from compliance. That requires regular communication and meaningful management involvement.

Give Compliance a Seat at the Table

Most business owners expect regular reporting from the departments they oversee. Sales teams report on revenue and business development. Finance reports on profitability, expenses, and cash flow. Operations reports on productivity and outstanding projects.

Why should compliance be different?

For many investment advisers, compliance reporting has never been formalized. The CCO may provide updates when a significant issue arises, and management may receive a copy of the annual compliance review. But there may be no regular process for discussing the department’s activities, evaluating its workload, or monitoring outstanding compliance obligations.

Firms should consider establishing a regular compliance reporting process appropriate for their size and complexity. For some advisers, that might mean a quarterly meeting between the CCO and senior management. For others, compliance reporting might become a standing agenda item at executive management meetings.

The reporting doesn’t need to be elaborate, but it should give leadership visibility into several important areas:

• Annual compliance reviews: When was the last review completed, when is the next one due, and what work remains outstanding?
• Compliance testing: Which tests were scheduled, which were completed, and what significant findings resulted?
• Outstanding deficiencies: What issues remain unresolved, who is responsible for correcting them, and when are corrections expected?
• Regulatory obligations: Are required filings current, and have business or regulatory changes created a need to update policies?
• Department resources: Does compliance have sufficient staffing, technology, and management support to fulfill its responsibilities?

These are the kinds of questions business owners routinely ask other departments.

They also address several weaknesses identified in the SEC’s Risk Alert. For example, the SEC observed firms that identified corrective actions during annual reviews but failed to implement them. In some instances, firms reported that corrective actions had been completed even though the underlying problems persisted.

Regular management reporting can help identify those issues before they become examination findings. It also provides an opportunity to understand why corrective actions may be delayed. Perhaps compliance needs additional resources, another department hasn’t implemented a required change, or management needs to make a decision.

Without regular reporting, those issues can remain unresolved indefinitely.

Accountability also requires visibility. Business owners should expect compliance professionals to perform their assigned responsibilities, but they must provide appropriate resources, establish clear expectations, and maintain reasonable oversight.

That doesn’t mean the CEO needs to conduct compliance testing or review every workpaper. Nor should management interfere with the CCO’s professional judgment or independence.

It means management should understand whether important compliance obligations are being fulfilled and whether the department has what it needs to do its job.

Build a Resilient Compliance Program

Regular reporting is important, but it doesn’t eliminate key person risk.

Firms should also consider whether their compliance programs can continue functioning when important employees are unavailable. That doesn’t necessarily require hiring additional compliance personnel.

For some firms, expanding the department may be appropriate. For others, the better solution may involve improving documentation, cross-training existing employees, using technology, or engaging external compliance resources.

The objective is to reduce the firm’s dependence on any single individual.

If your CCO resigned tomorrow, could another employee locate the firm’s compliance testing records? Could someone identify outstanding remediation items from the last annual review? Would the firm have access to the procedures used to conduct compliance testing? Could another qualified professional step in and determine what needed to happen next?

These questions should have answers before an employee announces their resignation.

Centralized compliance records, documented procedures, shared calendars, and compliance management technology can all help preserve institutional knowledge. Cross-training other employees on selected administrative responsibilities can provide additional continuity.

External compliance support can also play an important role, particularly for smaller and midsize advisers that may not need or be able to justify additional full-time compliance personnel.

An experienced compliance consulting firm can assist with testing, annual reviews, regulatory filings, policy maintenance, and other recurring responsibilities. One of the less frequently discussed benefits of a strong external relationship is institutional continuity.

Your CCO might receive an offer from another firm paying $20,000 more. They might decide to retire or spend six months hiking the Appalachian Trail.

Whatever the reason, the firm’s regulatory obligations remain.

A well-established external compliance partner may provide continuity through a team of professionals familiar with the adviser’s business and compliance program. That institutional knowledge can be valuable when internal personnel change.

Of course, outsourcing creates its own considerations. A consulting firm that conducts an annual review once a year, with little understanding of the adviser’s operations, may provide limited continuity.

The relationship needs to involve regular communication, access to relevant compliance records, and a genuine understanding of the firm’s business.

There is a difference between engaging a vendor to complete assigned tasks and developing a relationship with an external compliance partner that understands the business and helps maintain continuity.

And outsourcing doesn’t transfer the adviser’s regulatory responsibilities to the provider. The firm remains responsible for its compliance program and must maintain appropriate oversight of any delegated functions.

The Real Lesson for Investment Adviser Owners

The SEC’s September Risk Alert addresses missed annual reviews, inadequate testing procedures, outdated policies, incomplete documentation, and failures to implement corrective actions.

But viewed from a business management perspective, those findings raise questions about how investment advisers organize and oversee their compliance functions.

A missed annual review may indicate that nobody was monitoring the compliance calendar. Missing documentation may indicate that the firm lacks adequate systems for preserving institutional knowledge. Unresolved corrective actions may indicate that compliance doesn’t have sufficient authority, resources, or management support.

Not every compliance deficiency points to a management failure. But the SEC’s observations should encourage business owners to examine whether they have sufficient visibility into one of the firm’s most important functions.

Business owners don’t need to become compliance officers. They do need to understand how their compliance departments operate, what work is being performed, and whether the firm has the resources and systems necessary to meet its obligations.

Which brings us back to our CEO, whose CCO just announced she’s leaving in two weeks.

Finding her replacement is certainly a priority. But perhaps the more immediate concern is determining whether the firm’s compliance program can continue functioning without her. The time to find out whether your compliance program depends too heavily on one person is before that person leaves.