RIA Compliance and Practice Management Blog

What to Expect When Your RIA Firm is Going to be Audited (and How to Prepare)

Posted by RIA in a Box

Mar 31, 2014 9:30:00 AM

RIA Audit
This blog post was updated on August 24th, 2021 to reflect current regulatory priorities and best practices for registered investment advisor "RIA" firms to prepare for an audit. 

If you are wondering what is involved in an RIA audit, then you probably received notice that the SEC or state regulators will be visiting your office soon. If so, count yourself lucky! They could have chosen to conduct a surprise examination.

There are several potential reasons your firm is being audited. Whether it’s a routine inspection, for-cause inspection or sweep inspection, the regulatory team will know why they’re there and what they’re looking for.

As your firm’s Chief Compliance Officer (CCO), preparation for this inevitable review starts with you, so it’s important to know what is involved in an RIA audit. 

How to prepare for an RIA audit

Proper preparation for an investment adviser regulatory examination begins long before the auditor arrives in your RIA firm's office. If your firm performs and documents risk assessments and compliance tests—in addition to conducting an annual firm-wide review—you shouldn’t expect too many surprises. 

Here are a few best practices to consider before and during your firm's RIA compliance examination:

RIA Audit Checklist

1. Designate a point person

We strongly recommend designating a point person and making sure everyone in the office knows who this person is—typically the CCO. If you have various staff members assigned to RIA compliance procedures, select one person to serve as the main contact with the auditors.

2. Give the auditors a comfortable place to work

It’s always a good idea to have a conference room or office available that is away from the everyday activities. Show the RIA examiner(s) where the coffee and restrooms are located, but don't be offended if they refuse even a cup of coffee.

3. Prepare a brief presentation on your firm

Perhaps prepare a brief 5 minute introduction of your firm for the auditors; introducing your firm persons and identifying the services offered. This should match the information found in your RIA firm's Form ADV 2A and 2B regulatory filings. It’s a nice introduction by you to the auditors to show your firm's preparation and respect for the regulatory audit process. This is also the time to emphasize your firm’s commitment to a “Culture of Compliance” which sets the proper tone for the balance of the audit. Keep in mind that the auditors will likely already know a lot of this information but will want to hear how you describe your firm.

4. Know where all important documents are located

In an optional entrance interview, the auditors will typically discuss why they are there and begin to ask preliminary questions about your RIA firm. This may also be the time when the examiners present their checklist used to conduct the exam if you haven’t received a document request when the audit was announced. Be ready, able and willing to assist the auditors with their requests for additional information or documents.

5. Have a system in place to retrieve requested items

The auditor will request numerous documents throughout the audit and will likely ask for copies to take back to their office. If you store all your documents electronically, consider creating a separate online electronic folder that the auditors can access, etc. These requests should go through your “point person”. Remember to make copies of, or keep a listing of, all documents the auditors ask to take. If you’re using paper files, it is good practice to remove the entire file from the file cabinet, and take it back to where the auditors are working.

6. Explain any potential deficiencies

Once the regulators are finished with the in-office portion of the audit, they will normally speak with you before they leave. This is called an exit interview and may consist of the auditors’ findings and should give you an idea of what you can expect on a follow-up deficiency letter. Sometimes, you can clear up any potential deficiencies with brief explanations during this interview. 

7. Gather the necessary records

SEC Rule 204-2 requires SEC-registered RIA firms to maintain and keep current the records listed below. State regulators will generally use the same list with some slight additions depending on your jurisdiction. The auditors typically review these items in detail and compare them with your updated disclosure documents and current practice.

Records Required During an RIA Audit

The following records are generally required during an RIA audit:

  1. Receipts and Disbursements Journals
  2. General and Auxiliary Ledgers
  3. Order Memoranda
  4. Bank Records
  5. Bills and Statements
  6. Financial Statements
  7. Written Communications and Agreements (including electronic transmissions)
  8. List of Discretionary Accounts
  9. Advertising
  10. Personal Transactions of Representatives and Principals
  11. Client Records:
    • Powers Granted by Clients
    • Disclosure Statements
    • Solicitors’ Disclosure Statements
    • Performance Claims
    • Customer Information Forms and Suitability Information
    • Written Supervisory Procedures

The following records are generally required of investment advisory firms who have custody of clients' assets:

  1. Journals of Securities Transactions and Movements
  2. Separate Client Ledgers
  3. Copies of Confirmations
  4. Record by Security Showing Each Client’s Interest and Location Thereof

The following records are generally required of RIA firms that manage clients' assets:

(Note: these records must be maintained in an easily accessible place for a period of five years from the end of the fiscal year during which the last entry was made, and, for the first two years, the records must be maintained in the investment adviser’s principal office.)

  1. Client Purchases and Sales History
  2. Current Client Securities Positions

One of the best ways to know what is involved in an RIA audit is to look at the most common issues uncovered by regulators nationwide.

social - Audit-Deficiencies

The North American Securities Administrators Association (NASAA) puts out a biannual survey of state regulators compiling their findings. In the 2019 NASAA Exam sweeps report, the top five RIA compliance deficiencies noted were:

  1. Books and Records Deficiencies (missing contracts and suitability documentation)
  2. Registration Issues (mismatched ADV Part 1 and Part 2 filings, fee structure problems)
  3. Contract Deficiencies (not signed, improper fees, hedge clauses)
  4. Cybersecurity (inadequate insurance, no testing of vulnerability, security procedures) 
  5. Fees (fee charged doesn’t match contract or ADV, charging miscalculated fees)

It’s simply not feasible to become RIA audit ready overnight and it takes more than just establishing a compliance program at your RIA firm to be compliant. When you know what is involved in an RIA audit and have put in the work to prepare, you will find it goes much more smoothly.

Would you like help to implement an annual compliance review into your current processes? Click here to learn more about our Annual Review Tool

Download Our Free How to Prepare for an RIA Regulatory Exam Checklist  


Topics: RIA Compliance

RIA in a Box LLC is not a law firm, investment advisory firm, or CPA firm. RIA in a Box LLC does not provide legal advice or opinions to any party or client. You should always consult your relevant regulatory authorities or legal counsel if applicable.

RIA Compliance & Practice Management

Stay up to date on the latest RIA compliance, operations, and technology topics.

Hear from industry experts as they keep you up to date on the latest regulatory developments and practice management topics.

Subscribe to Email Updates

Recent Posts