My RIA Lawyer

The real test of a compliance program often comes when someone asks the firm to produce the evidence behind it.

For a growing RIA, “we have the records” is not enough. Leadership should know whether the firm can identify, retrieve, validate, explain and produce information quickly across systems, offices and personnel.

The best time to find that weakness is before a regulator is waiting for the answer.

Q3 is in the books. Now what?

Before the year accelerates into Q4, ask what leadership actually learned about the performance of the compliance structure.

If your firm changed materially this year but the infrastructure underneath compliance did not, now is the time to find the weak points.

Message us “PERFORMANCE” to learn about our Regulatory Performance Stress Test™.

Growth is a good problem to have.

But success can also create blind spots.

The best time to test your infrastructure is when the business is doing well—not after something has gone wrong.

Make sure your compliance infrastructure is keeping pace with your momentum.

September is your window to identify regulatory infrastructure problems before Q4 becomes crowded with annual reviews, budgeting and year-end priorities.

If the firm has materially changed this year, do not assume the compliance structure kept pace.

Test it while you still control the timing.

An acquisition is not fully integrated just because the technology and branding are aligned.

Compliance culture, supervision, documentation and accountability have to be integrated too.

Otherwise, growth can create regulatory debt leadership does not see until much later.

Make sure the next chapter is built on one defensible operating model—not several inherited ones.

As 2027 budgeting begins, compliance should not be treated as a carry-forward line item.

Ask your CCO: “What part of our compliance program would you least want tested tomorrow?”

That answer can tell leadership where next year’s investment actually needs to go.

The strongest budgets are built around the risks the firm actually has—not last year’s assumptions.

Multi-office RIAs can look centralized on paper while operating very differently in practice.

Different documentation habits, supervisory expectations, escalation practices and inherited workflows can slowly create several versions of compliance underneath one firm.

The bigger the organization becomes, the more important consistency becomes.

The SEC just issued a Risk Alert focused on how RIAs are conducting their annual compliance reviews.

The observations are a useful reminder that an annual review is more than checking a box at year-end. SEC exam staff identified firms that missed reviews, did not follow their own review procedures, failed to update policies when the business changed, did not keep supporting workpapers, and failed to complete corrective action after issues were identified.

One point is especially important: annual training and employee attestations do not replace the annual review itself.

A strong review should help the firm answer: What did we test? What did we find? What changed in the business? What needs to be fixed? And can we prove what happened?

If regulators evaluated your firm tomorrow, where would leadership have the least confidence?

Could you produce evidence quickly? Are procedures consistent across offices? Are exceptions documented? Do policies match actual practice?

This isn't about predicting an examination. It is about identifying weak points while leadership still controls the timing.

Try this with your leadership team: If your CCO were unavailable for the next 30 days, what would actually stop working?

Advertising review? Testing? Filings? Remediation? Vendor oversight? Exam response?

The answer tells you whether your compliance function is operating as a resilient system—or whether too much of the system is actually one person's institutional knowledge.

For a growing RIA, that distinction matters.