What the SEC Priorities Mean to Me as Your Chief Compliance Officer
As I read the Securities and Exchange Commission’s (SEC) Division of Examinations 2027 examination priorities, one thought was recurring; a firm cannot effectively supervise what it does not understand.
Compliance starts with understanding how a firm’s business actually operates. Written policies matter, but they need to reflect the decisions people make, the systems they use, and the risks they encounter every day.
Cybersecurity has to be a significant part of that work. In my conversations with clients, we have explored emerging technology, how supervised persons understand the policies that apply to them, and how firms protect client information. I view my role as a way to connect SEC expectations with operations by asking practical questions: Who owns the control? When does a concern need to be escalated? What evidence tells us supervision is working?
What stands out for investment advisers
The priorities reinforce the importance of fiduciary duties, conflicts of interest, and the basis for investment recommendations. Firms should be able to explain how a recommendation fits a client’s circumstances, especially when an investment is complex or illiquid. Examiners will also consider whether compliance programs have adapted as firms introduce services, serve different clients, or change their business models.
Cybersecurity, third-party oversight, and emerging technology belong in that conversation, too. Each requires us to understand how the firm operates and whether its controls address the risks those operations create.
What a healthy compliance program looks like
- Compliance joins the conversation early. New services, investments, affiliations, vendors, and technology reach compliance while there is still time to evaluate conflicts, disclosures, and necessary changes to controls.
- People understand their responsibilities. Supervised persons know which policies apply to their roles, how to protect client information, and when and to whom they should escalate a concern.
- Testing tells us something useful. We test the controls the firm relies on in practice, assess whether they work, and use the results to determine what needs attention.
- Client records support the advice. Documentation explains the basis for recommendations in light of each client’s circumstances, including relevant risks, liquidity needs, time horizon, and costs.
The annual review should reflect the year
The SEC staff’s September observations on annual compliance reviews highlighted delays and reviews that did not adequately assess firms’ policies and practices. That is a reminder of why we should not want to wait until year-end to look under the hood. The annual review should bring together what we have learned through supervision and testing throughout the year.
Throughout the year, I want to keep asking: Do disclosures accurately describe the business? Do operating practices match written procedures? Does testing address the risks that matter to your firm? When something needs attention, do the people responsible have the authority and resources to address it, and do we follow up to confirm the changes worked? Calls are an opportunity to make those connections. Bring compliance into conversations about changes in business, questions about current practices, or policies that no longer seem to fit. Together, we can keep supervision aligned with how your firm operates and address concerns while there is still time to act.