What I Looked for in the First 30 Minutes of an SEC Examination

"Recidivism" is a word I learned early in my stint as an SEC examiner. It was important back then and it is just as important today. When an examiner sees that a past deficiency has not been corrected or taken seriously, alarm bells go off. It signals that the firm does not take SEC rules seriously -- and in my experience, that signal is almost never wrong. Firms that ignore prior findings rarely have just one problem. They tend to have several, and the examination that was supposed to be routine becomes something considerably more uncomfortable.

SEC examiner inspects the books and records of a registered investment adviser.

I thought about this a lot when I later sat on the other side of the table as CCO, preparing my own firm for examination. The first 30 minutes tell an examiner most of what they need to know. Here is what they are looking for.

Whether anyone actually read the last deficiency letter

If your firm has been examined before, the examiner already knows what was found. They have your prior deficiency letter, and they will test those exact areas first. Firms that addressed prior findings with a policy update and nothing else -- no testing, no training, no evidence of implementation -- will have a hard time explaining why the same gap still exists three years later. Examiners are not unreasonable. They understand that compliance programs evolve. What they cannot accept is indifference.

If you have not been examined before, this still applies. The SEC publishes its examination priorities every year. If those priorities are nowhere in your compliance program, that absence is itself a finding waiting to happen.

Whether senior management is engaged or just tolerating compliance

This becomes clear very quickly, usually within the first interview. Examiners are trained to assess tone from the top and they are good at it. A CEO or portfolio manager who can speak fluently about the firm's compliance framework -- who knows what the Code of Ethics requires, who understands the conflict of interest disclosures in the ADV, who has actually read the compliance manual -- sends a very different message than one who defers every question to the CCO with a vague wave of the hand.

Senior management does not need to know every regulatory detail. But they need to demonstrate that compliance is taken seriously at the highest level of the firm. When they cannot, the examiner reasonably concludes that the tone from the top is weak -- and a weak tone from the top predicts weak compliance everywhere else.

Whether the compliance program reflects how the business actually operates

One of the most common things I encountered as an examiner was a compliance manual that described a firm that no longer existed. Strategies had changed. Personnel had turned over. New business lines had launched. But the policies still referenced the old structure, the old products, the old risks.

A compliance program that does not match the actual business is not a compliance program. It is a document. Examiners know the difference and they will find it quickly by asking simple operational questions and comparing the answers to what your policies say.

Whether the CCO has real authority or just a title

Small RIAs often designate a CCO as a regulatory requirement without giving that person the resources, access, or authority to do the job. Examiners look for this directly. Does the CCO have access to senior management? Do they participate in business decisions before they are made, or do they find out afterward? Is there a compliance budget? Has the firm invested in any compliance infrastructure at all?

Even if you are a small RIA without a dedicated full-time CCO, these questions matter. The designation alone is not enough. The SEC expects the function to be real.

The bottom line on tone

Being a registered investment adviser means you are a fiduciary. You have the privilege of managing the wealth of others and that is fundamentally a trust business. The loss of trust -- by investors, by employees, by regulators -- is disastrous in a way that is very difficult to recover from.

The first 30 minutes of an SEC examination are not really about documents. They are about whether your firm takes that responsibility seriously. Examiners can tell, usually before the first coffee goes cold, whether the answer is yes or no.

If you are not confident in what that answer would look like for your firm, that is worth addressing before you get the call -- not after.

Susan Kim is a former SEC examiner and the founder of No Bad Acts LLC, a compliance advisory firm serving investment advisers and private fund managers. She can be reached at skim@nobadacts.com.