Financial firms are used to running communications compliance reviews day-to-day, but the SEC's Compliance Rule asks for something separate: a step back to assess the firm's entire compliance program at least once a year.Under Rule 206(4)-7, every SEC-registered investment adviser has to review its own compliance policies and procedures on that same annual basis. The rule exists because a firm's business changes, regulations change, and a compliance program written two years ago may no longer match what the firm does. The annual review is meant to catch that gap before a client or an examiner does: it has to weigh whether the policies are adequate for the firm's current business, and whether they're being followed.
On September 14, the SEC's Division of Examinations issued a Risk Alert on how firms are conducting these annual reviews. The Division uses Risk Alerts to flag patterns its examiners have found across firms so advisers can address the same issues before an exam finds them. This one grouped its findings into six categories:
When policy and practice fall out of step, the effect shows up across the other five findings too. Once a firm isn't doing what its own policy requires, things get missed, standards slip, and accountability breaks down. Fixing that first problem makes the rest easier to solve.
The alert doesn't describe firms with bad policies or a lack of will. It describes firms whose practice moved on from their policies before they could be updated, a common scenario in an industry where technological and regulatory developments influence behavior at breakneck pace. An annual review only confirms alignment on the day it happens. A firm can be fully aligned in January and drift by March, with nobody finding out until the next review, or an exam.
Mira builds supervision policies from the firm's own handbook, cross-referenced against SEC and FINRA precedent, so the policy it enforces is the firm's actual policy, not a generic standard applied on top of it. Because it runs continuously, it doesn't wait for a scheduled review to notice when practice has moved away from policy. It catches that deviation as it happens, so the firm can act on it straight away, correcting the behavior, updating the policy, or both, rather than letting the gap sit until the next review finds it.
That's the shift from an annual snapshot to an ongoing state - alignment maintained continuously rather than reconstructed once a year under pressure. The firms this alert describes found out they'd drifted. With Mira, firms already know, and have had time to act.