What advisers can expect from an SEC exam

Congratulations, you’re one of the 10% of investment advisers the Securities and Exchange Commission is planning to examine this year.

Here’s what you can expect over the next couple of months, or — if you’re on the less fortunate end of the spectrum — up to a year.

The SEC exam experience has been described by advisers and lawyers who have participated in the process as everything from nerve-wracking to gruesome. The commission’s approach over the past few years of focusing on firms that represent the biggest risk to investors has inspectors showing up at adviser offices with a more hostile and assertive style, some say.

“The aggressive policy of the SEC is unlike anything I have ever seen in 30 years of doing this,” said Tom Giachetti, chairman of the securities practice group at the law firm of Stark & Stark. “Even the letters to firms are accusatory and all the while the threat of enforcement is held over them.”

Knowing what to expect and preparing for the week-long visit can make the exam process less painful, experts said. On the flip side, avoid providing lackadaisical answers to staff questions or trying to tell examiners what they should review and whom they should talk with.

/assets/docs src=”/wp-content/uploads2016/03/CI104291311.SVG”

PHONE CALL STARTS THE CLOCK TICKING

Advisory firms will typically get a phone call from the SEC’s Office of Compliance Inspections and Examinations announcing that inspectors will be visiting in about a month. The call will be followed up with a formal letter and document request.

The SEC usually seeks information covering a year or two, often including trading data, compliance manuals, client lists, investments, employees, performance ads and marketing, and all firm agreements. Advisers typically have about two weeks to begin electronically submitting documents, but the time frame can be much shorter.

Tanya Kerrigan, general counsel and chief compliance officer of Boston Advisors, said her firm received the call a few days before Christmas in 2014, and it was given two days to provide trading and client data. An impatient tone was evident from the start, she said.

“When I called them back, they immediately asked why I hadn’t returned their call sooner, and I told them I had been in a management meeting,” Ms. Kerrigan said. “I looked at what time they had called, and it was an hour earlier.”

The inspectors arrived at her advisory firm shortly after the new year.

(Related: The 6 most common SEC exam deficiencies)
Amy Lynch, founder of FrontLine Compliance, said her firm has noticed the pace of adviser exams picking up in recent years. Examiners of some of her clients have wanted written documents within a few days.

“It puts a lot of pressure on the [chief compliance officer],” she said. “It’s very challenging.”

The SEC is conducting such accelerated exams when it’s seeking to quickly learn about an issue regulators are worried about, said Renee Esfandiary, an OCIE assistant director. They want to gather as much information about industry practices as possible.

“Our recent exams that have been on very quick demand are usually because someone high up wants to know about things going on in the market,” she said. “Most of the time exams are over a much longer time, as in months.”

Examiners, who may be simultaneously working on two to five cases at a time, also may visit an advisory firm because they suspect something dubious is going on. OCIE has been doing more of these cause-based exams in recent years as the number of tips, complaints and whistleblower accusations have ramped up, Ms. Esfandiary said.

Investment advisers can start the process off on the right foot by meeting the document request deadlines, a task that will require advanced preparation to make sure the firm can deliver commonly sought information in the format the SEC wants. Firms also should prep their own employees to take extra cautions while the inspectors are on-site.

“Remind your staff to be cognizant of things that they say in the elevators, shouting down the hall and things like that,” said Brian Rubin, a securities attorney with Sutherland Asbill & Brennan.

(Editorial: Doing the math on RIA exams)

/assets/docs src=”/wp-content/uploads2016/03/CI104293311.SVG”

EXAM DAY 1

The day the examiners arrive, usually in a team of two to four people, firms should provide them with a comfortable and reasonably sized place to work. They will usually accept offers of a beverage, but not food.

Don’t be shocked if the SEC team shows up with an attorney from the enforcement division tagging along. It’s something Mr. Rubin said his firm is seeing more often.

SEC staff explanations of lawyers’ participation have included that they are “trying to learn what firms are really like” or “gathering general background,” or that someone from the exam or enforcement units thinks there is something specific to check into, he said.

The firm’s chief compliance officer should be in charge of the process on the firm side, even though other members of the staff will need to be around for interviews that day or later in the week.

The SEC wants to see that the CCO has the authority to make decisions and has the respect of senior management to handle all aspects of compliance, including having the sway to convince those at the top to change their ways if needed.

Mr. Rubin recommends senior management such as the president or chief operating officer be available that first day to provide the examiners with an overview of the firm. Inspectors visit many different types of firms with various business models, so a description of the business can help focus the exam staff, he said.

/assets/docs src=”/wp-content/uploads2016/03/CI104295311.SVG”

EXAM DAYS 2-5

In recent years, technology has changed the way SEC exams proceed. Namely, examiners are using big data tools to review years of trading data to quickly identify abnormalities, when previously they would have to search reams of data by hand.

Examiners analyzed three years of trading data from Boston Advisors and came to the on-site visit ready to ask about five instances that were “not average trades,” Ms. Kerrigan said. The firm had to explain the anomalies.

Firms should be analyzing their own trading data to look for irregularities long before regulators show up at the door, compliance lawyers said.

Firms’ cybersecurity policies and practices are among the issues SEC examiners are likely to ask about — and find fault with.

The majority of advisory firms the SEC staff examines are deficient in cybersecurity, and it’s often because there’s opportunity for potential breaches from human beings, Ms. Esfandiary said.

Mock compliance audits are one way for firms to identify potential issues before SEC examiners do so. More advisers are engaging experts or internal staff to run the firm through a simulated exam, according to a survey last year from the Investment Adviser Association.

During the week, examiners often will want to speak with employees from multiple departments within the advisory firm, including staff in information technology and marketing. It’s a good idea to have a compliance lawyer taking notes when employees are interviewed, Mr. Rubin said.

The SEC staff also is likely to ask the advisory firm for additional documents during the on-site visit.

At Demming Financial Services Corp.’s first-ever adviser exam in September 2014, it took two people five days, working up to 10 hours a day, to gather all the information the inspectors asked for, said Karen Bordonaro, the firm’s CCO.

She said SEC examiners “were incredibly comprehensive.”

On the last day of the exam visit, SEC staff may conduct a preliminary “exit interview” to discuss the status of the exam and any outstanding information they still want. The inspectors also may discuss issues the exam has turned up.

/assets/docs src=”/wp-content/uploads2016/03/CI104296311.SVG”

WEEKS, MONTHS LATER

After the visit, the SEC staff continues to analyze the information it collected and may contact the firm to clarify questions or, again, request more information.

Commission rules require compliance exams be completed six months after the SEC staff finishes the on-site portion of the exam, or six months after the staff receives all the records it has requested, “whichever is later.”

Some exams can last for up to a year, causing great stress to advisory firm executives, Mr. Giachetti said. Six months into one examination, a New York advisory client told him he thought he was going to have a heart attack from the strain.

“I wake up in a panic thinking they are going to tell me I’m doing something wrong,” he told Mr. Giachetti.

Most commonly, the exam process ends with a letter notifying the firm of the areas where it’s been found to be deficient. Advisers must respond within 30 days, describing the steps they will take or have already taken to address the issues and prevent reoccurrences.

“It’s unusual for a registrant to have everything perfect,” Ms. Esfandiary said.

The SEC no longer publishes in its annual report the percentage of exams that result in deficiency letters, but it’s “a high portion,” she said. In 2011, 82% of firms that were examined received such letters.

In addition to deficiency letters, the exam staff can send issues to the enforcement division for possible action. In 2015, OCIE made more than 200 referrals to enforcement.
The SEC is trying to boost the number of adviser exams it completes each year, shifting some examiners away from brokers and refocusing them on RIAs. It also plans to use some budget increases to hire additional exam staff and is drafting a rule to allow third-party examiners.

So your odds of getting that phone call from the SEC could go up in the next few years. Be prepared.