examination-readiness

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Examination Readiness — SEC & FINRA Regulatory Examinations

审查准备 — SEC与FINRA监管审查

Purpose

目的

Prepare registered investment advisers, broker-dealers, and their compliance teams for SEC and FINRA examinations. This skill covers the full examination lifecycle — from risk-based selection and notification through document production, staff interviews, deficiency findings, remediation, and follow-up. It provides frameworks for mock examinations, annual compliance reviews, and proactive use of published examination priorities to reduce regulatory risk.

为注册投资顾问、经纪交易商及其合规团队应对SEC和FINRA审查提供支持。本技能覆盖完整审查周期——从基于风险的筛选与通知，到文件提交、员工访谈、缺陷认定、整改及后续跟进。它提供模拟审查、年度合规审查的框架，并指导主动运用已发布的审查重点来降低监管风险。

Layer

层级

9 — Compliance & Regulatory Guidance

9 — 合规与监管指引

Direction

方向

prospective

前瞻性

When to Use

适用场景

Receiving an SEC or FINRA examination notification letter and preparing a response
Organizing and producing documents in response to an initial document request list (IDR)
Responding to a deficiency letter or examination findings
Designing or conducting an internal mock examination program
Reviewing SEC or FINRA annual examination priorities for proactive compliance planning
Conducting the annual compliance review required under SEC Rule 206(4)-7
Assessing whether the firm's compliance program, policies, and procedures are examination-ready
Preparing key personnel for staff interviews during an examination
Evaluating remediation progress after prior examination findings
Building an examination readiness checklist organized by functional area
Advising a newly registered firm on what to expect from its first regulatory examination

收到SEC或FINRA审查通知函并准备回复
整理并提交文件以响应初始文件请求清单（IDR）
回应缺陷函或审查认定结果
设计或开展内部模拟审查计划
审阅SEC或FINRA年度审查重点，进行主动合规规划
开展SEC Rule 206(4)-7要求的年度合规审查
评估公司合规计划、政策及流程是否符合审查要求
准备关键人员应对审查期间的员工访谈
评估先前审查认定后的整改进度
按职能领域构建审查准备清单
为新注册公司提供首次监管审查的预期事项指导

Core Concepts

核心概念

SEC Examination Process (Division of Examinations)

SEC审查流程（审查部）

The SEC's Division of Examinations (formerly the Office of Compliance Inspections and Examinations, or OCIE) conducts examinations of registered entities including investment advisers, broker-dealers, transfer agents, clearing agencies, and self-regulatory organizations. The Division uses a risk-based approach to select firms for examination and to determine the scope and intensity of each exam.

Risk-based selection. The Division selects firms for examination based on a range of risk indicators rather than examining every registrant on a fixed schedule. Selection criteria include:

New registrant status — Newly registered investment advisers and broker-dealers are frequently examined within the first one to three years of registration. These initial examinations assess whether the firm has implemented the compliance infrastructure described in its registration filings.
Risk indicators and quantitative screens — The Division uses data analytics to identify firms with characteristics associated with higher risk: rapid asset growth, concentrated portfolios, high employee turnover, customer complaint patterns, significant regulatory history, unusual fee structures, or material conflicts of interest.
Tips, complaints, and referrals — Complaints from investors, tips from whistleblowers (including those submitted under the SEC Whistleblower Program established by Section 21F of the Securities Exchange Act of 1934), and referrals from other SEC divisions or regulatory bodies can trigger cause examinations.
Sweep examinations — The Division periodically conducts industry-wide sweep examinations focused on a single issue or practice across many firms simultaneously. Recent sweep topics have included off-channel communications, Reg BI implementation, private fund fee practices, and ESG-related disclosures.

Types of examinations:

Routine/periodic examinations — Scheduled examinations conducted as part of the Division's ongoing oversight program. These typically cover a broad range of compliance topics and may review multiple years of activity.
Cause examinations — Triggered by a specific complaint, tip, referral, or red flag. Cause examinations are typically narrower in scope, focused on the specific issue that prompted the examination, but can expand if additional problems are discovered.
Sweep examinations — Industry-wide examinations focused on a single topic. Sweep exams allow the Division to assess industry-wide compliance with a particular rule or to evaluate emerging risks across many firms. Results often inform future rulemaking or guidance.

Examination lifecycle:

Notification letter — The examination begins with a notification letter (sometimes called an "announcement letter") sent to the firm. The letter identifies the examination team, provides an initial document request list (IDR), and specifies a deadline for document production (typically two to four weeks). For cause examinations, the notification may be abbreviated or, in rare circumstances, the examination may begin without advance notice.
Document production — The firm produces the requested documents, typically through a secure file-sharing platform. The initial IDR is often extensive (see the Document Production section below). The examination staff may issue supplemental document requests as they review the initial production.
On-site or remote examination — Examination staff conduct their review either on-site at the firm's offices or remotely (remote examinations became common during and after the COVID-19 pandemic and remain a standard option). The review includes analysis of documents, records, and data.
Staff interviews — Examiners conduct interviews with key personnel, typically including the Chief Compliance Officer (CCO), portfolio managers, traders, operations staff, and senior management. Interviews may be informal discussions or more structured questioning sessions. Firms should prepare interviewees by reviewing relevant policies and recent compliance activity, but should not coach witnesses to give scripted answers.
Follow-up requests — As the examination progresses, staff frequently issue additional document requests or ask clarifying questions based on their findings. Responsiveness and transparency during this phase are important.
Exit conference — Near the end of the examination, staff typically hold an exit conference with the firm to discuss preliminary observations and potential areas of concern. The exit conference is not a formal proceeding, and the observations discussed may change before a final determination is made.
Outcome — The examination concludes with one of several outcomes: (a) a no-action letter or no further action (the examination revealed no material issues); (b) a deficiency letter identifying compliance deficiencies and requesting a written response describing corrective actions; (c) a referral to the SEC's Division of Enforcement for potential enforcement action (reserved for more serious violations or patterns of non-compliance).

Typical duration. SEC examinations typically last from several weeks to several months, depending on the firm's size, the scope of the examination, the complexity of issues discovered, and the responsiveness of the firm's document production.

Firms' rights during examination. Firms have the right to: receive identification of the examination staff and their supervisors; understand the general scope of the examination; request reasonable extensions for document production deadlines (extensions are granted at the staff's discretion); have counsel present during interviews (though the SEC may interview individuals separately); and receive a closing communication describing the examination outcome. Firms may also submit a response to preliminary findings discussed at the exit conference before a deficiency letter is finalized.

SEC审查部（原合规检查与审查办公室，即OCIE）对注册实体进行审查，包括投资顾问、经纪交易商、过户代理人、清算机构及自律组织。该部门采用基于风险的方法选择审查对象，并确定每次审查的范围和强度。

基于风险的筛选。审查部根据一系列风险指标选择审查对象，而非按固定时间表审查所有注册机构。筛选标准包括：

新注册机构状态——新注册的投资顾问和经纪交易商通常在注册后的1至3年内接受审查。这些初始审查旨在评估公司是否已落实注册文件中描述的合规基础设施。
风险指标与量化筛选——审查部利用数据分析识别具有高风险特征的公司：资产快速增长、投资组合集中、员工流动率高、客户投诉模式、重大监管历史、异常收费结构或重大利益冲突。
线索、投诉与转介——投资者投诉、举报人提供的线索（包括根据1934年《证券交易法》第21F条设立的SEC举报人计划提交的线索），以及其他SEC部门或监管机构的转介，可能触发针对性审查。
专项审查——审查部定期开展全行业专项审查，同时聚焦多个公司的单一问题或操作。近期专项审查主题包括非官方渠道沟通、Reg BI实施、私募基金收费操作及ESG相关披露。

审查类型：

常规/定期审查——作为审查部持续监督计划的一部分进行的定期审查。这类审查通常涵盖广泛的合规主题，可能涉及多年的活动。
针对性审查——由特定投诉、线索、转介或警示信号触发。针对性审查范围通常较窄，聚焦引发审查的特定问题，但如果发现其他问题，范围可能扩大。
专项审查——全行业范围内聚焦单一主题的审查。专项审查使审查部能够评估全行业对特定规则的合规情况，或评估多家公司的新兴风险。审查结果通常为未来的规则制定或指引提供信息。

审查周期：

通知函——审查始于向公司发送的通知函（有时称为“公告函”）。函件明确审查团队，提供初始文件请求清单（IDR），并指定文件提交的截止日期（通常为2至4周）。对于针对性审查，通知可能简化，在极少数情况下，审查可能在未提前通知的情况下开始。
文件提交——公司通过安全文件共享平台提交所需文件。初始IDR通常内容广泛（见下文文件提交部分）。审查人员在审阅初始提交的文件后，可能发出补充文件请求。
现场或远程审查——审查人员在公司办公室现场或远程进行审阅（远程审查在COVID-19疫情期间及之后变得普遍，仍是标准选项）。审阅包括对文件、记录和数据的分析。
员工访谈——审查人员与关键人员进行访谈，通常包括首席合规官（CCO）、投资组合经理、交易员、运营人员及高级管理人员。访谈可能是非正式讨论，也可能是更结构化的提问环节。公司应为受访者准备相关政策和近期合规活动的复习，但不应指导证人给出脚本化答案。
后续请求——随着审查的推进，审查人员经常根据发现的问题发出额外的文件请求或提出澄清问题。此阶段的响应速度和透明度至关重要。
退出会议——审查接近尾声时，审查人员通常与公司举行退出会议，讨论初步观察结果和潜在关注领域。退出会议并非正式程序，讨论的观察结果可能在最终确定前发生变化。
结果——审查以以下几种结果之一结束：(a) 无行动函或无进一步行动（审查未发现重大问题）；(b) 缺陷函，指出合规缺陷并要求提交书面回复说明纠正措施；(c) 转介至SEC执法部，采取潜在执法行动（针对更严重的违规或不合规模式）。

典型时长。SEC审查通常持续数周至数月，具体取决于公司规模、审查范围、发现问题的复杂性以及公司文件提交的响应速度。

公司在审查中的权利。公司有权：获取审查人员及其主管的身份信息；了解审查的大致范围；请求合理延长文件提交截止日期（延长需经审查人员酌情批准）；访谈时聘请律师在场（尽管SEC可能单独约谈个人）；收到描述审查结果的结案沟通。公司还可在缺陷函最终确定前，对退出会议上讨论的初步观察结果提交回复。

FINRA Examination Process

FINRA审查流程

FINRA (the Financial Industry Regulatory Authority) examines its member broker-dealer firms through its Risk Monitoring and Examination programs. As a self-regulatory organization (SRO), FINRA has direct authority to examine, sanction, and discipline its members — a key distinction from the SEC, which must refer potential enforcement actions to its Division of Enforcement.

Types of FINRA examinations:

Cycle examinations — Regular examinations conducted on a schedule determined by the firm's risk profile. Higher-risk firms are examined more frequently (annually or even continuously for the largest firms), while lower-risk firms may be examined on a two- to four-year cycle. The cycle exam typically covers a broad range of compliance areas.
Cause examinations — Triggered by specific concerns such as customer complaints, tips, unusual trading patterns, financial difficulties, or referrals from other regulators. Cause exams are focused on the specific issue that prompted the examination.
Sweep examinations — Similar to SEC sweeps, FINRA conducts targeted reviews across multiple firms to assess industry-wide compliance with specific rules or to evaluate emerging risks.

Risk-based approach. FINRA assigns each member firm a risk rating based on a comprehensive assessment of factors including the firm's business model, product mix, customer demographics, complaint history, financial condition, regulatory history, and supervisory structure. This risk rating determines examination frequency and intensity.

Annual risk assessment — FINRA provides firms with an annual risk assessment summary identifying the key risk areas FINRA associates with the firm's business. This summary can be a valuable tool for compliance planning.
Examination priorities letter — FINRA publishes an annual examination and risk monitoring priorities letter identifying the topics and issues that will be focal points for the coming year. This letter is a critical compliance planning resource (see the Annual Examination Priorities section below).

Key differences from SEC examinations:

Direct sanction authority — FINRA can impose sanctions directly through its Department of Enforcement, including fines, suspensions, bars, expulsions, and censures. The SEC, by contrast, must bring enforcement actions through its own Division of Enforcement or through administrative proceedings.
Financial surveillance — FINRA conducts ongoing financial surveillance of member firms, including monitoring net capital compliance (SEC Rule 15c3-1), reviewing FOCUS reports (Financial and Operational Combined Uniform Single reports filed monthly or quarterly), and assessing the financial health of firms. FINRA may take emergency action if a firm's financial condition deteriorates below minimum thresholds.
Trade surveillance — FINRA operates sophisticated market surveillance programs (including the Cross-Market Surveillance system) to detect potential market manipulation, insider trading, and other trading violations.

FINRA（金融业监管局）通过其风险监控和审查计划对会员经纪交易商进行审查。作为自律组织（SRO），FINRA拥有直接审查、制裁和处罚其会员的权力——这与SEC的关键区别在于，SEC必须将潜在执法行动转介至其执法部。

FINRA审查类型：

周期审查——根据公司风险状况确定的时间表进行的定期审查。高风险公司审查频率更高（每年一次，甚至对大型公司持续审查），而低风险公司可能每2至4年审查一次。周期审查通常涵盖广泛的合规领域。
针对性审查——由特定担忧触发，如客户投诉、线索、异常交易模式、财务困难或其他监管机构的转介。针对性审查聚焦引发审查的特定问题。
专项审查——与SEC专项审查类似，FINRA对多家公司进行定向审查，以评估全行业对特定规则的合规情况或评估新兴风险。

基于风险的方法。FINRA根据对公司商业模式、产品组合、客户群体、投诉历史、财务状况、监管历史和监督结构等因素的综合评估，为每个会员公司分配风险评级。该风险评级决定审查频率和强度。

年度风险评估——FINRA向公司提供年度风险评估摘要，明确FINRA认为与公司业务相关的关键风险领域。该摘要可作为合规规划的宝贵工具。
审查重点函——FINRA每年发布审查和风险监控重点函，确定来年的重点关注主题和问题。该函是合规规划的关键资源（见下文年度审查重点部分）。

与SEC审查的主要区别：

直接制裁权——FINRA可通过其执法部直接实施制裁，包括罚款、暂停执业、禁止从业、除名和谴责。相比之下，SEC必须通过其自身执法部或行政程序提起执法行动。
财务监控——FINRA对会员公司进行持续财务监控，包括监控净资本合规性（SEC Rule 15c3-1）、审阅FOCUS报告（每月或每季度提交的财务与运营综合统一报告），以及评估公司的财务健康状况。如果公司财务状况恶化至最低阈值以下，FINRA可能采取紧急行动。
交易监控——FINRA运营复杂的市场监控程序（包括跨市场监控系统），以检测潜在的市场操纵、内幕交易和其他交易违规行为。

Annual Examination Priorities

年度审查重点

Both the SEC Division of Examinations and FINRA publish annual examination priorities or focus areas that signal where regulatory attention will be concentrated in the coming year. These publications are among the most important compliance planning tools available.

SEC Division of Examinations annual priorities. The Division publishes its examination priorities early each calendar year. Recent recurring themes have included:

Regulation Best Interest (Reg BI) compliance — Assessment of broker-dealer compliance with Reg BI's Disclosure, Care, Conflict of Interest, and Compliance Obligations (17 CFR 240.15l-1). The SEC has examined both the written policies and the actual practices of firms, with particular attention to whether recommendations are in the customer's best interest and whether conflicts are adequately disclosed and mitigated.
Investment adviser fiduciary duty — Examination of advisers' compliance with their fiduciary obligations, including duty of care and duty of loyalty, as interpreted by the SEC in its June 2019 Fiduciary Interpretation.
Private fund advisers — Scrutiny of fee calculations, expense allocations, performance reporting, preferential treatment of certain investors (side letters), and compliance with new rules under the Investment Advisers Act.
ESG and sustainability claims — Review of whether advisers and funds that market themselves as ESG-focused actually implement the ESG investment processes they describe. The SEC has brought enforcement actions for "greenwashing" — claiming ESG integration that does not occur in practice.
Cybersecurity and information security — Assessment of firms' cybersecurity programs, including governance, access controls, data loss prevention, incident response plans, vendor management, and compliance with Regulation S-P (privacy of consumer financial information) and Regulation S-ID (identity theft red flags).
Crypto and digital assets — Examination of firms offering digital asset products or services, including custody arrangements, valuation practices, and compliance with securities laws.
Off-channel communications — Review of whether firms are capturing and retaining business-related communications conducted through personal devices, text messages, messaging apps (WhatsApp, Signal, iMessage), or other channels outside the firm's approved communication platforms. This has been a major enforcement focus, with the SEC and FINRA imposing billions of dollars in combined penalties across dozens of firms.
Anti-money laundering — Review of AML programs, particularly SAR filing practices, customer risk rating, and beneficial ownership due diligence.
Marketing Rule compliance — Assessment of compliance with the SEC's Marketing Rule (Rule 206(4)-1), including performance advertising, hypothetical performance, testimonials, and endorsements.

FINRA annual examination priorities. FINRA's annual report on examination and risk monitoring activities similarly identifies key focus areas. Recurring FINRA priorities include:

Reg BI and Form CRS — Compliance with Regulation Best Interest and the requirement to deliver and file Form CRS.
Communications with the public — Compliance with FINRA Rule 2210, including social media supervision and digital communications.
Market integrity — Surveillance for manipulative trading, best execution compliance, and order handling obligations.
Financial crimes — AML program effectiveness, fraud detection, and sanctions compliance.
Firm operations — Net capital compliance, customer protection (Rule 15c3-3), books and records, and business continuity planning.

Using exam priority letters for proactive compliance planning. Firms should treat published examination priorities as a roadmap for their own internal compliance reviews. Best practices include:

Reading the SEC and FINRA priority letters immediately upon publication and assessing the firm's readiness in each identified area.
Conducting targeted internal reviews or mock examinations of the highest-priority topics.
Updating compliance policies and procedures to address new or evolving priority areas.
Allocating compliance resources — staff time, technology, and budget — to priority areas.
Briefing senior management and the board on examination priorities and the firm's preparedness.

SEC审查部和FINRA均会发布年度审查重点或关注领域，预示来年监管关注的重点。这些出版物是最重要的合规规划工具之一。

SEC审查部年度重点。审查部每年年初发布其审查重点。近期反复出现的主题包括：

最佳利益监管规则（Reg BI）合规——评估经纪交易商对Reg BI的披露、谨慎、利益冲突和合规义务（17 CFR 240.15l-1）的合规情况。SEC审查了公司的书面政策和实际操作，特别关注建议是否符合客户最佳利益，以及利益冲突是否得到充分披露和缓解。
投资顾问受托责任——审查顾问对受托义务的合规情况，包括注意义务和忠诚义务，如SEC在2019年6月的受托解释中所述。
私募基金顾问——审查费用计算、费用分配、业绩报告、对某些投资者的优惠待遇（附函），以及《投资顾问法》新规的合规情况。
ESG与可持续性声明——审查自称关注ESG的顾问和基金是否实际实施了其描述的ESG投资流程。SEC已针对“漂绿”行为提起执法行动——即声称进行ESG整合但实际并未落实。
网络安全与信息安全——评估公司的网络安全计划，包括治理、访问控制、数据丢失预防、事件响应计划、供应商管理，以及对Regulation S-P（消费者金融信息隐私）和Regulation S-ID（身份盗用警示信号）的合规情况。
加密与数字资产——审查提供数字资产产品或服务的公司，包括托管安排、估值操作，以及证券法合规情况。
非官方渠道沟通——审查公司是否捕获并保留通过个人设备、短信、消息应用（WhatsApp、Signal、iMessage）或公司批准通信平台以外的其他渠道进行的业务相关沟通。这一直是执法重点，SEC和FINRA已对数十家公司处以总计数十亿美元的罚款。
反洗钱——审查反洗钱计划，特别是可疑活动报告（SAR）提交操作、客户风险评级和受益所有人尽职调查。
营销规则合规——评估对SEC营销规则（Rule 206(4)-1）的合规情况，包括业绩广告、假设业绩、推荐和背书。

FINRA年度审查重点。FINRA关于审查和风险监控活动的年度报告同样明确了关键关注领域。FINRA反复强调的重点包括：

Reg BI与Form CRS——对最佳利益监管规则和交付及提交Form CRS要求的合规情况。
与公众的沟通——对FINRA Rule 2210的合规情况，包括社交媒体监督和数字沟通。
市场完整性——监控操纵性交易、最佳执行合规性和订单处理义务。
金融犯罪——反洗钱计划有效性、欺诈检测和制裁合规情况。
公司运营——净资本合规性、客户保护（Rule 15c3-3）、账簿和记录，以及业务连续性规划。

利用审查重点函进行主动合规规划。公司应将已发布的审查重点作为内部合规审查的路线图。最佳实践包括：

审查函发布后立即阅读，并评估公司在每个确定领域的准备情况。
对最高优先级主题进行定向内部审查或模拟审查。
更新合规政策和流程，以应对新的或不断演变的重点领域。
将合规资源（员工时间、技术和预算）分配给重点领域。
向高级管理层和董事会通报审查重点及公司的准备情况。

Document Production and Requests

文件提交与请求

Document production is often the most operationally demanding phase of a regulatory examination. The initial document request list (IDR) sets the tone for the examination, and the quality and timeliness of the firm's response significantly influences the examination experience.

Typical items on an initial document request list. While every IDR is tailored to the specific examination, common elements include:

Compliance program documents — Written compliance policies and procedures (the compliance manual), code of ethics, annual compliance review reports, CCO designation documentation, compliance committee meeting minutes.
Organizational and governance documents — Organizational charts, ownership structure, affiliated entity relationships, board or governance committee minutes, management committee meeting minutes.
Registration and regulatory documents — Current and historical Form ADV (Parts 1, 2A, 2B), Form BD, Form CRS, state registration filings, regulatory examination history, correspondence with regulators.
Advertising and marketing materials — All advertisements, pitchbooks, fact sheets, website content, social media archives, client newsletters, performance presentations, and the advertising review log.
Client documents — Client agreements (advisory agreements, brokerage agreements), fee schedules, client onboarding documents, suitability or Reg BI documentation, account opening documents.
Fee and billing records — Fee calculation methodology, billing records, fee schedules, any fee adjustments or waivers, accounts with negotiated fees.
Trading and investment records — Trade blotters, order tickets, allocation records, best execution reviews, soft dollar arrangements, brokerage committee minutes, directed brokerage documentation.
Complaint and litigation records — Customer complaint log, complaint files, litigation and arbitration history, regulatory action history, whistleblower complaints.
Exception reports — Trade error logs, personal trading exception reports, gifts and entertainment logs, outside business activity records, political contribution records.
Cybersecurity and technology — Written information security policy, incident response plan, business continuity plan, vendor due diligence files, penetration testing reports, cybersecurity risk assessments, data breach history.
AML program documents — AML compliance program, OFAC screening procedures, SAR filing records, CTR filing records, AML independent testing report.
Books and records — Financial statements, trial balances, FOCUS reports (for broker-dealers), net capital computations, customer reserve computations.

Scope management. Effective scope management is critical to a successful examination response:

Understand the request — Before gathering documents, carefully read each IDR item to ensure you understand what is being asked. If an item is ambiguous, seek clarification from the examination staff promptly.
Gather documents systematically — Assign responsibility for each IDR item to specific individuals, with clear deadlines. Use a tracking spreadsheet or project management tool to monitor completion.
Quality review before production — Before submitting documents, a senior compliance person (ideally the CCO or outside counsel) should review the production for completeness, accuracy, and consistency. Look for inadvertent production of privileged documents.
Privilege considerations — Attorney-client privileged documents and attorney work product should be identified and withheld from production. Prepare a privilege log if withholding documents on privilege grounds. Inadvertent production of privileged documents can result in waiver of the privilege.
Document hold obligations — Upon receiving an examination notification, the firm should implement a document hold to ensure that no relevant documents are destroyed, altered, or deleted during the examination. This includes suspending automatic deletion policies for emails and electronic records within the scope of the examination.

Electronic document production. Examination staff increasingly expect electronic production:

Documents should be produced in their native format or as searchable PDFs, organized by IDR item number.
Metadata should be preserved unless the examination staff specifies otherwise.
Email production should include headers, attachments, and threading information.
Large productions are typically submitted through SEC or FINRA secure file-sharing platforms.
Maintain an index of all documents produced, cross-referenced to each IDR item.

文件提交通常是监管审查中对运营要求最高的阶段。初始文件请求清单（IDR）为审查定下基调，公司响应的质量和及时性对审查体验有重大影响。

初始文件请求清单的典型内容。虽然每个IDR都针对具体审查定制，但常见内容包括：

合规计划文件——书面合规政策和流程（合规手册）、道德准则、年度合规审查报告、CCO任命文件、合规委员会会议纪要。
组织与治理文件——组织结构图、所有权结构、关联实体关系、董事会或治理委员会会议纪要、管理委员会会议纪要。
注册与监管文件——当前及历史Form ADV（第1、2A、2B部分）、Form BD、Form CRS、州注册文件、监管审查历史、与监管机构的往来函件。
广告与营销材料——所有广告、推介手册、情况说明书、网站内容、社交媒体存档、客户通讯、业绩演示文稿，以及广告审查日志。
客户文件——客户协议（咨询协议、经纪协议）、收费时间表、客户入职文件、适当性或Reg BI文件、开户文件。
费用与账单记录——费用计算方法、账单记录、收费时间表、任何费用调整或减免、协商费用账户。
交易与投资记录——交易记录、订单凭证、分配记录、最佳执行审查报告、软美元安排、经纪委员会会议纪要、定向经纪文件。
投诉与诉讼记录——客户投诉日志、投诉文件、诉讼和仲裁历史、监管行动历史、举报人投诉。
例外报告——交易错误日志、个人交易例外报告、礼品和娱乐日志、外部业务活动记录、政治献金记录。
网络安全与技术——书面信息安全政策、事件响应计划、业务连续性计划、供应商尽职调查文件、渗透测试报告、网络安全风险评估、数据泄露历史。
反洗钱计划文件——反洗钱合规计划、OFAC筛查流程、SAR提交记录、CTR提交记录、反洗钱独立测试报告。
账簿与记录——财务报表、试算平衡表、FOCUS报告（经纪交易商）、净资本计算、客户准备金计算。

范围管理。有效的范围管理对成功应对审查至关重要：

理解请求——在收集文件前，仔细阅读每个IDR条目，确保理解要求。如果条目模糊，及时向审查人员寻求澄清。
系统收集文件——将每个IDR条目的责任分配给特定人员，并设定明确的截止日期。使用跟踪电子表格或项目管理工具监控完成情况。
提交前质量审查——提交文件前，资深合规人员（理想情况下为CCO或外部律师）应审查提交文件的完整性、准确性和一致性。注意避免意外提交享有特权的文件。
特权考虑——律师-客户特权文件和律师工作成果应被识别并免于提交。如果以特权为由扣留文件，需准备特权日志。意外提交特权文件可能导致特权丧失。
文件保留义务——收到审查通知后，公司应实施文件保留措施，确保审查期间相关文件不被销毁、篡改或删除。这包括暂停审查范围内电子邮件和电子记录的自动删除政策。

电子文件提交。审查人员越来越期望电子提交：

文件应以原生格式或可搜索PDF格式提交，按IDR条目编号整理。
除非审查人员另有说明，否则应保留元数据。
电子邮件提交应包含邮件头、附件和线程信息。
大量提交通常通过SEC或FINRA安全文件共享平台进行。
保留所有提交文件的索引，并与每个IDR条目交叉引用。

Common Deficiency Findings

常见缺陷认定

Understanding the most frequently cited deficiency areas allows firms to focus their compliance efforts where examination risk is highest. Across SEC and FINRA examinations, the following categories consistently generate the most findings.

(a) Compliance program gaps. Deficiencies in the overall compliance program are among the most common findings:

Outdated policies and procedures that have not been revised to reflect current regulations, business practices, or organizational changes.
Policies that do not match actual practices — "paper compliance" where written procedures exist but are not followed in practice.
Failure to conduct the annual compliance review required under SEC Rule 206(4)-7, or conducting a review that is superficial and does not meaningfully assess the adequacy of the compliance program.
Insufficient compliance resources — a CCO without adequate time, authority, budget, or staff to implement the compliance program effectively.

(b) Books and records violations. Books and records deficiencies are pervasive:

Incomplete records, including missing trade confirmations, account statements, or client correspondence.
Communication archiving failures — failure to capture and retain business-related communications, particularly those conducted through personal devices, text messages, or unapproved messaging platforms. This has been one of the most heavily penalized areas in recent years, with the SEC and FINRA imposing penalties exceeding $2 billion across more than 60 firms for off-channel communication recordkeeping failures.
Failure to maintain required books and records in the format and for the retention periods specified by SEC Rules 17a-3, 17a-4 (broker-dealers) and Rule 204-2 (investment advisers).

(c) Advertising violations. Advertising deficiencies are a top examination focus:

Misleading performance presentations, including showing gross-only performance without corresponding net performance, cherry-picking favorable time periods, or presenting backtested performance without required disclosures.
Testimonials without required disclosures under the SEC Marketing Rule (Rule 206(4)-1).
Social media posts by associated persons that were not reviewed, approved, or archived by the firm.
Failure to maintain the advertising review log or to document the compliance review process for marketing materials.

(d) Custody rule issues. Custody deficiencies arise frequently for investment advisers:

Inadvertent custody — situations where an adviser has custody of client assets without recognizing it (e.g., through authority to deduct fees from client accounts, serving as trustee of a client trust, or controlling a client's bill-paying service).
Failure to comply with the surprise examination requirement when the adviser has custody.
Failure to ensure that qualified custodians send account statements directly to clients at least quarterly.

(e) Fee calculation errors. Fee-related deficiencies are a recurring concern:

Overbilling clients due to incorrect asset valuations, failure to apply fee breakpoints, or charging fees on assets that should be excluded (such as legacy positions or cash).
Failure to calculate fees consistent with the methodology described in the advisory agreement or Form ADV Part 2A.
Not refunding overbilled fees promptly upon discovery.

(f) Code of ethics violations. Code of ethics deficiencies include:

Unreported personal trading by access persons in violation of SEC Rule 204A-1.
Failure to obtain pre-clearance for personal trades in reportable securities.
Inadequate monitoring of gifts and entertainment, particularly from broker-dealers, custodians, or other service providers.
Failure to collect and review initial and annual holdings reports and quarterly transaction reports from access persons.

(g) Cybersecurity weaknesses. Cybersecurity deficiencies have become increasingly prominent:

Lack of a written information security policy or a policy that is not tailored to the firm's specific technology environment and risks.
Inadequate access controls, including failure to implement multi-factor authentication, excessive user privileges, and lack of timely deprovisioning of former employee accounts.
Failure to conduct regular vulnerability assessments or penetration testing.
Inadequate incident response planning and testing.
Insufficient vendor due diligence for third-party service providers with access to firm systems or client data.

Deficiency letter structure. A deficiency letter from the SEC Division of Examinations typically identifies each deficiency by category, describes the specific factual findings, cites the applicable rule or statutory provision, and requests a written response within 30 days (or another specified period) describing the corrective actions the firm has taken or plans to take. FINRA deficiency letters follow a similar format. The letter may also note areas where the staff observed practices that, while not rising to the level of a deficiency, could be improved.

了解最常被提及的缺陷领域，可使公司将合规工作聚焦于审查风险最高的地方。在SEC和FINRA审查中，以下类别始终产生最多的认定结果。

(a) 合规计划漏洞。整体合规计划的缺陷是最常见的认定结果之一：

未更新的政策和流程，未反映当前法规、业务操作或组织变化。
政策与实际操作不符——“纸面合规”，即存在书面流程但实际未遵循。
未开展SEC Rule 206(4)-7要求的年度合规审查，或审查流于形式，未切实评估合规计划的充分性。
合规资源不足——CCO没有足够的时间、权限、预算或员工来有效实施合规计划。

(b) 账簿与记录违规。账簿与记录缺陷普遍存在：

记录不完整，包括缺失交易确认书、账户对账单或客户往来函件。
通信存档失败——未捕获和保留业务相关通信，特别是通过个人设备、短信或未批准消息平台进行的通信。这是近年来处罚最严厉的领域之一，SEC和FINRA已因非官方渠道通信记录保存失败对60多家公司处以超过20亿美元的罚款。
未按SEC Rule 17a-3、17a-4（经纪交易商）和Rule 204-2（投资顾问）规定的格式和保留期限保存所需账簿与记录。

(c) 广告违规。广告缺陷是审查的重点：

误导性业绩展示，包括仅展示总业绩而未展示相应净业绩、挑选有利时间段，或展示回测业绩但未进行必要披露。
未按SEC营销规则（Rule 206(4)-1）要求进行披露的推荐内容。
关联人员发布的社交媒体帖子未经过公司审查、批准或存档。
未保留广告审查日志或未记录营销材料的合规审查流程。

(d) 托管规则问题。投资顾问经常出现托管缺陷：

无意托管——顾问在未意识到的情况下拥有客户资产的托管权（例如，有权从客户账户中扣除费用、担任客户信托的受托人，或控制客户的账单支付服务）。
当顾问拥有托管权时，未遵守突击审查要求。
未确保合格托管人至少每季度直接向客户发送账户对账单。

(e) 费用计算错误。费用相关缺陷是反复出现的问题：

因资产估值错误、未应用费用断点或对应排除资产（如 legacy头寸或现金）收取费用而导致多收客户费用。
未按咨询协议或Form ADV第2A部分所述方法计算费用。
发现多收费用后未及时退款。

(f) 道德准则违规。道德准则缺陷包括：

访问人员未报告个人交易，违反SEC Rule 204A-1。
未对可报告证券的个人交易进行事前审批。
对礼品和娱乐的监控不足，特别是来自经纪交易商、托管人或其他服务提供商的礼品和娱乐。
未收集和审查访问人员的初始及年度持股报告和季度交易报告。

(g) 网络安全薄弱环节。网络安全缺陷日益突出：

缺乏书面信息安全政策，或政策未针对公司特定技术环境和风险定制。
访问控制不足，包括未实施多因素认证、用户权限过大，以及未及时注销前员工账户。
未定期进行漏洞评估或渗透测试。
事件响应规划和测试不足。
对有权访问公司系统或客户数据的第三方服务提供商的供应商尽职调查不足。

缺陷函结构。SEC审查部的缺陷函通常按类别列出每个缺陷，描述具体事实认定，引用适用规则或法规条款，并要求在30天（或其他指定期限）内提交书面回复，说明公司已采取或计划采取的纠正措施。FINRA缺陷函格式类似。函件还可能指出审查人员观察到的虽未达到缺陷程度但可改进的领域。

Deficiency Response and Remediation

缺陷回复与整改

How a firm responds to a deficiency letter is a critical determinant of whether the matter is resolved at the examination stage or escalated to enforcement.

Responding to a deficiency letter:

Timeline — Deficiency letters typically require a written response within 30 days. If additional time is needed, request an extension promptly and explain the reason. Most examination staff will grant reasonable extensions, particularly if remediation is complex.
Content of the response — The response should address each deficiency finding individually and include: (1) an acknowledgment of the finding (or, if the firm disagrees, a clear and respectful explanation of why); (2) a description of the corrective action already taken; (3) a timeline for completing any remediation not yet finished; (4) identification of the person or persons responsible for each corrective action; (5) a description of any enhanced controls or monitoring implemented to prevent recurrence.
Tone — The response should be professional, thorough, and constructive. Defensive or dismissive responses increase the risk of escalation. Where the firm agrees with a finding, acknowledge it directly. Where the firm disagrees, present the factual and legal basis for the disagreement clearly, without being adversarial.
Legal review — Have compliance counsel (internal or external) review the response before submission. The response becomes part of the firm's regulatory record and may be referenced in future examinations or enforcement proceedings.

Remediation best practices:

Root cause analysis — For each deficiency, identify the root cause — not just the symptoms. Was the deficiency caused by a policy gap, a training failure, a technology limitation, a staffing shortfall, or a failure of supervisory oversight? Effective remediation requires addressing the underlying cause.
Policy updates — Revise policies and procedures to address the identified deficiency. Ensure the revised policy is specific and actionable, not merely aspirational.
Enhanced training — Provide targeted training to the personnel involved in the deficiency area. Document the training content, attendees, and date.
Monitoring for recurrence — Implement testing or monitoring procedures to verify that the corrective action is effective and that the deficiency does not recur. For example, if a deficiency involved fee calculation errors, implement a periodic fee billing audit.
Testing effectiveness — After a reasonable period (typically 60 to 90 days), test whether the remediation is working as intended. Document the testing results.
Documentation — Maintain a comprehensive remediation file for each deficiency, including the original finding, root cause analysis, corrective actions taken, policy revisions, training records, monitoring results, and effectiveness testing. This file should be readily available for the next examination.

Distinction between outcomes:

Deficiency letter (requiring response) — The most common outcome when issues are identified. The firm must respond in writing describing corrective actions.
Examination findings with no further action — The examination staff may communicate observations informally (at the exit conference or in a closing letter) without issuing a formal deficiency letter. These observations should still be taken seriously and addressed proactively.
Referral to enforcement — In cases involving serious violations, patterns of non-compliance, harm to investors, fraud, or failure to remediate prior deficiencies, the examination staff may refer the matter to the SEC Division of Enforcement or FINRA's Department of Enforcement for potential formal action. Referrals may result in civil penalties, disgorgement, cease-and-desist orders, censures, suspensions, or bars.

公司对缺陷函的回应方式，是决定问题在审查阶段解决还是升级为执法行动的关键因素。

回应缺陷函：

时间线——缺陷函通常要求在30天内提交书面回复。如果需要更多时间，应及时请求延期并说明原因。大多数审查人员会批准合理的延期，特别是当整改工作复杂时。
回复内容——回复应逐一回应每个缺陷认定，包括：(1) 确认认定结果（如果公司不同意，应清晰、礼貌地解释原因）；(2) 描述已采取的纠正措施；(3) 完成未完成整改的时间线；(4) 确定每项纠正措施的负责人；(5) 描述为防止再次发生而实施的任何强化控制或监控措施。
语气——回复应专业、全面且具有建设性。防御性或轻蔑性的回复会增加升级风险。如果公司同意认定结果，应直接确认。如果不同意，应清晰陈述不同意的事实和法律依据，避免对抗性。
法律审查——提交回复前，应由合规律师（内部或外部）进行审查。回复将成为公司监管记录的一部分，并可能在未来审查或执法程序中被引用。

整改最佳实践：

根本原因分析——针对每个缺陷，确定根本原因，而非仅解决症状。缺陷是由政策漏洞、培训失败、技术限制、人员短缺还是监督失败导致的？有效的整改需要解决根本原因。
政策更新——修订政策和流程以解决已识别的缺陷。确保修订后的政策具体且可操作，而非仅仅是理想化的表述。
强化培训——为缺陷涉及的人员提供定向培训。记录培训内容、参与者和日期。
监控复发情况——实施测试或监控程序，验证纠正措施有效且缺陷不再复发。例如，如果缺陷涉及费用计算错误，应实施定期费用账单审计。
测试有效性——在合理期限后（通常为60至90天），测试整改是否按预期发挥作用。记录测试结果。
文档记录——为每个缺陷维护全面的整改文件，包括原始认定结果、根本原因分析、已采取的纠正措施、政策修订、培训记录、监控结果和有效性测试。该文件应随时可供下次审查使用。

结果区分：

缺陷函（需回复）——发现问题时最常见的结果。公司必须提交书面回复说明纠正措施。
审查认定结果且无进一步行动——审查人员可能非正式地（在退出会议或结案函中）传达观察结果，而不发布正式缺陷函。这些观察结果仍应被认真对待并主动解决。
转介至执法部门——在涉及严重违规、不合规模式、投资者损害、欺诈或未整改先前缺陷的情况下，审查人员可能将事项转介至SEC执法部或FINRA执法部，采取潜在正式行动。转介可能导致民事罚款、 disgorgement、停止令、谴责、暂停执业或禁止从业。

Mock Examination Frameworks

模拟审查框架

Internal mock examinations are one of the most effective tools for maintaining examination readiness and identifying compliance gaps before regulators do.

Designing a mock examination program:

Frequency — Conduct mock examinations at least annually. Higher-risk areas or areas where deficiencies were previously identified should be reviewed more frequently (semi-annually or quarterly).
Scope selection — Use the SEC and FINRA annual examination priorities as a starting point for selecting mock exam topics. Also consider areas where the firm has experienced compliance incidents, client complaints, or operational changes.
Simulate the document request — Prepare a mock IDR modeled on actual SEC or FINRA document request lists. Issue the mock IDR to the relevant business units and compliance personnel with a realistic deadline.
Test document retrieval and production capabilities — Evaluate whether the firm can locate, compile, and organize the requested documents within the specified timeframe. Identify bottlenecks in document retrieval — areas where records are disorganized, incomplete, or difficult to access.
Interview key personnel — Conduct mock interviews with personnel who would be interviewed during an actual examination (CCO, portfolio managers, traders, operations staff). Assess whether they can articulate the firm's compliance practices, describe their roles accurately, and respond to probing questions without becoming defensive or evasive.
Identify gaps — Document all gaps, weaknesses, and areas for improvement identified during the mock examination. Categorize findings by severity (critical, significant, minor) and functional area.
Report results — Prepare a written report summarizing the mock examination findings and recommendations. Present the report to senior management, the compliance committee, or the board of directors, as appropriate. The report should include specific remediation recommendations with assigned owners and deadlines.
Track remediation — Follow up on remediation of mock examination findings using the same discipline applied to actual regulatory findings.

Using compliance consultants. Firms may engage external compliance consultants to conduct independent mock examinations. External mock exams provide several benefits: the consultant brings fresh perspective and experience from examinations at other firms; the exercise is more realistic because business personnel interact with an unfamiliar examiner; and the results carry more weight with senior management. When selecting a consultant, prioritize individuals with recent SEC or FINRA examination experience.

内部模拟审查是维持审查准备状态并在监管机构发现前识别合规漏洞的最有效工具之一。

设计模拟审查计划：

频率——至少每年进行一次模拟审查。高风险领域或先前发现缺陷的领域应更频繁地审查（每半年或每季度一次）。
范围选择——以SEC和FINRA年度审查重点为起点选择模拟审查主题。还应考虑公司经历过合规事件、客户投诉或运营变化的领域。
模拟文件请求——根据实际SEC或FINRA文件请求清单准备模拟IDR。向相关业务部门和合规人员发布模拟IDR，并设定合理的截止日期。
测试文件检索与提交能力——评估公司是否能在指定时间范围内查找、整理和组织所需文件。识别文件检索中的瓶颈——记录混乱、不完整或难以访问的领域。
访谈关键人员——与实际审查中会被访谈的人员（CCO、投资组合经理、交易员、运营人员）进行模拟访谈。评估他们是否能清晰阐述公司的合规操作、准确描述其角色，并在面对追问时不防御或回避。
识别漏洞——记录模拟审查中发现的所有漏洞、薄弱环节和改进领域。按严重程度（关键、重大、轻微）和职能领域对认定结果进行分类。
报告结果——准备书面报告总结模拟审查的认定结果和建议。根据情况向高级管理层、合规委员会或董事会提交报告。报告应包括具体的整改建议、指定负责人和截止日期。
跟踪整改——以处理实际监管认定结果的同样纪律，跟进模拟审查认定结果的整改情况。

利用合规顾问。公司可聘请外部合规顾问进行独立模拟审查。外部模拟审查有几个好处：顾问带来新鲜视角和其他公司审查的经验；由于业务人员与不熟悉的审查人员互动，练习更真实；结果对高级管理层更有分量。选择顾问时，优先考虑具有近期SEC或FINRA审查经验的人员。

Annual Compliance Review (Rule 206(4)-7)

年度合规审查（Rule 206(4)-7）

SEC Rule 206(4)-7 under the Investment Advisers Act of 1940 requires every registered investment adviser to: (1) adopt and implement written policies and procedures reasonably designed to prevent violation of the Advisers Act and its rules; (2) designate a chief compliance officer responsible for administering the compliance program; and (3) review the adequacy of the policies and procedures and the effectiveness of their implementation at least annually.

Conducting the annual review. The annual compliance review is a regulatory requirement, not a discretionary exercise. It should be documented in writing and presented to senior management. The review should assess:

Regulatory changes — Identify new rules, rule amendments, SEC guidance, no-action letters, and enforcement actions that may require updates to the firm's policies and procedures. Each regulatory change should be mapped to the specific policy or procedure it affects.
Compliance incidents and outcomes — Review all compliance incidents that occurred during the review period, including trade errors, policy violations, customer complaints, regulatory inquiries, and the outcomes of those incidents. Assess whether the incidents reveal patterns or systemic weaknesses.
Testing results — Summarize the results of compliance testing conducted during the review period, including trade surveillance testing, advertising review, fee billing audits, code of ethics monitoring, and any mock examination findings.
Training completion — Confirm that all required compliance training was completed during the review period. Identify any personnel who did not complete required training and the steps taken to address the gap.
Vendor oversight — Review the firm's oversight of third-party service providers, including custodians, sub-advisers, technology vendors, and other material service providers. Assess whether vendor due diligence was conducted and whether vendor performance and compliance were monitored.
Technology changes — Evaluate whether changes to the firm's technology environment (new systems, platform migrations, cybersecurity incidents) require updates to compliance policies or procedures.
Organizational changes — Assess the impact of any organizational changes — new business lines, personnel changes, office openings or closings, mergers or acquisitions — on the compliance program.
Recommendations — The annual review should conclude with specific, actionable recommendations for improving the compliance program, along with a timeline and responsible persons for implementation.

Documentation. The annual compliance review must be documented. While the SEC does not prescribe a specific format, the documentation should be sufficient to demonstrate that a thorough review was conducted. SEC examination staff regularly request the annual compliance review report as one of their first IDR items.

1940年《投资顾问法》项下的SEC Rule 206(4)-7要求每个注册投资顾问：(1) 采用并实施合理设计的书面政策和流程，以防止违反《顾问法》及其规则；(2) 指定负责管理合规计划的首席合规官；(3) 至少每年审查政策和流程的充分性及其实施的有效性。

开展年度审查。年度合规审查是监管要求，而非可自由决定的事项。审查应以书面形式记录并提交给高级管理层。审查应评估：

监管变化——识别可能需要更新公司政策和流程的新规则、规则修订、SEC指引、无行动函和执法行动。每个监管变化应映射到其影响的具体政策或流程。
合规事件与结果——审查审查期间发生的所有合规事件，包括交易错误、政策违规、客户投诉、监管询问，以及这些事件的结果。评估事件是否揭示了模式或系统性薄弱环节。
测试结果——总结审查期间进行的合规测试结果，包括交易监控测试、广告审查、费用账单审计、道德准则监控，以及任何模拟审查认定结果。
培训完成情况——确认所有要求的合规培训在审查期间已完成。识别未完成要求培训的人员及解决该漏洞所采取的步骤。
供应商监督——审查公司对第三方服务提供商的监督，包括托管人、子顾问、技术供应商和其他重要服务提供商。评估是否进行了供应商尽职调查，以及是否监控了供应商的绩效和合规情况。
技术变化——评估公司技术环境的变化（新系统、平台迁移、网络安全事件）是否需要更新合规政策或流程。
组织变化——评估任何组织变化（新业务线、人员变动、办公室开设或关闭、合并或收购）对合规计划的影响。
建议——年度审查应得出改进合规计划的具体、可操作建议，以及实施的时间线和负责人。

文档记录。年度合规审查必须记录在案。虽然SEC未规定具体格式，但文档应足以证明进行了全面审查。SEC审查人员经常将年度合规审查报告作为首批IDR项目之一要求提交。

Examination Readiness Checklist

审查准备清单

The following checklist, organized by functional area, identifies key documents and evidence that should be organized, current, and readily accessible at all times — not assembled only when an examination is announced.

Registration and organizational:

Current Form ADV Parts 1, 2A, 2B (and all amendments filed during the review period)
Current Form CRS (for dual registrants)
Form BD and FINRA membership documents (for broker-dealers)
Organizational charts reflecting current structure
Ownership and control documentation
List of affiliated entities and related persons
State registration filings

Compliance program:

Written compliance policies and procedures (current version with revision history)
Code of ethics (current version)
CCO designation documentation
Annual compliance review report (current and prior two years)
Compliance committee or management meeting minutes
Compliance calendar showing scheduled activities and deadlines
Compliance testing reports and results
Regulatory correspondence file (all communications with SEC, FINRA, state regulators)
Prior examination deficiency letters and the firm's responses
Remediation tracking documentation

Trading and investments:

Trade blotters and order tickets
Trade allocation records and allocation policies
Best execution review documentation
Soft dollar arrangement records and Section 28(e) analysis
Brokerage committee or trading committee minutes
Directed brokerage documentation
Error correction log and resolution documentation

Advertising and marketing:

Advertising review log (all materials reviewed, with dates, reviewer, and disposition)
Copies of all advertisements disseminated (print, digital, social media, email)
Social media archives (all platforms used by the firm and associated persons)
Performance calculation support (worksheets, data sources, methodologies)
Hypothetical performance policies and procedures

Custody and client assets:

Custody determination analysis
Surprise examination engagement letter and report (if applicable)
Qualified custodian statements (confirming direct client delivery)
Fee deduction authorization documentation

AML and financial crimes:

AML compliance program (written procedures)
AMLCO designation
AML independent testing report (current and prior year)
AML training records
SAR filing records and supporting documentation
OFAC screening records and procedures
Customer risk rating documentation

Cybersecurity:

Written information security policy
Incident response plan (current, tested)
Business continuity plan (current, tested)
Vulnerability assessment and penetration testing reports
Vendor due diligence files for technology service providers
Data breach notification records (if any)
Employee cybersecurity training records

Books and records:

Financial statements (current and prior two years)
FOCUS reports (broker-dealers)
Net capital computations (broker-dealers)
Customer reserve computations (broker-dealers)
Client agreements (advisory and brokerage)
Fee schedules and billing records
Complaint log and complaint files
Personal trading reports (initial and annual holdings, quarterly transactions)
Gifts and entertainment log
Outside business activity records
Political contribution records

以下按职能领域组织的清单，列出了应随时整理、更新并易于获取的关键文件和证据——不应仅在审查宣布时才整理。

注册与组织：

当前Form ADV第1、2A、2B部分（及审查期间提交的所有修正案）
当前Form CRS（双重注册机构）
Form BD和FINRA会员文件（经纪交易商）
反映当前结构的组织结构图
所有权和控制文件
关联实体和相关人员清单
州注册文件

合规计划：

书面合规政策和流程（当前版本及修订历史）
道德准则（当前版本）
CCO任命文件
年度合规审查报告（当前及前两年）
合规委员会或管理会议纪要
显示预定活动和截止日期的合规日历
合规测试报告和结果
监管往来函件档案（与SEC、FINRA、州监管机构的所有通信）
先前审查缺陷函及公司回复
整改跟踪文档

交易与投资：

交易记录和订单凭证
交易分配记录和分配政策
最佳执行审查文档
软美元安排记录和第28(e)条分析
经纪委员会或交易委员会会议纪要
定向经纪文件
错误纠正日志和解决文档

广告与营销：

广告审查日志（所有已审查材料，含日期、审查人及处理结果）
所有发布的广告副本（印刷品、数字、社交媒体、电子邮件）
社交媒体存档（公司及关联人员使用的所有平台）
业绩计算支持材料（工作表、数据源、方法）
假设业绩政策和流程

托管与客户资产：

托管认定分析
突击审查委托函和报告（如适用）
合格托管人对账单（确认直接交付给客户）
费用扣除授权文件

反洗钱与金融犯罪：

反洗钱合规计划（书面流程）
反洗钱合规官任命
反洗钱独立测试报告（当前及前一年）
反洗钱培训记录
SAR提交记录和支持文档
OFAC筛查记录和流程
客户风险评级文档

网络安全：

书面信息安全政策
事件响应计划（当前版本，已测试）
业务连续性计划（当前版本，已测试）
漏洞评估和渗透测试报告
技术服务提供商的供应商尽职调查文件
数据泄露通知记录（如有）
员工网络安全培训记录

账簿与记录：

财务报表（当前及前两年）
FOCUS报告（经纪交易商）
净资本计算（经纪交易商）
客户准备金计算（经纪交易商）
客户协议（咨询和经纪）
收费时间表和账单记录
投诉日志和投诉文件
个人交易报告（初始及年度持股、季度交易）
礼品和娱乐日志
外部业务活动记录
政治献金记录

Worked Examples

示例

Example 1: Newly registered RIA receives first SEC examination notification

示例1：新注册RIA收到首次SEC审查通知

Scenario: A registered investment adviser that has been in operation for 18 months and manages $350 million in client assets receives its first SEC examination notification letter. The firm has four employees: the founder/portfolio manager (who is also the designated CCO), a junior analyst, an operations manager, and an administrative assistant. The initial document request list contains 45 items spanning compliance policies, trading records, advertising materials, fee calculations, and cybersecurity documentation. The firm has 21 calendar days to produce the documents. The CCO has never been through a regulatory examination.

Compliance Issues:

New registrants are a high-priority examination category for the SEC Division of Examinations. The staff will assess whether the firm has actually implemented the compliance program described in its Form ADV.
A firm with the founder serving as both portfolio manager and CCO presents an inherent conflict of interest — the CCO is overseeing the compliance of the person who also manages the firm and makes investment decisions. SEC staff will scrutinize whether the compliance function is genuinely independent and effective.
With only four employees, the firm has limited resources to manage a 45-item document request while continuing normal operations.
New registrants frequently have compliance policies that were adopted at registration but never updated or tailored to reflect the firm's actual practices as the business developed during its first 18 months.

Analysis: The CCO should take the following steps immediately upon receiving the notification letter. First, engage outside compliance counsel or a compliance consultant with SEC examination experience — attempting to navigate a first examination without experienced guidance significantly increases risk. Second, assign responsibility for each IDR item to a specific person with a clear internal deadline (at least five days before the SEC deadline to allow for quality review). Third, conduct a rapid self-assessment: compare the firm's written compliance policies to its actual practices and identify any material gaps. If the compliance manual was adopted at registration but not updated since, this gap will be apparent to examiners and should be acknowledged proactively. Fourth, prepare for staff interviews — the SEC will almost certainly interview the CCO/founder at length about the compliance program, fee calculations, trading practices, and advertising. The founder should be able to articulate the firm's investment process, compliance controls, and how conflicts of interest (including the dual PM/CCO role) are managed. Fifth, review the firm's Form ADV for accuracy — the examination staff will compare the ADV disclosures to actual practices, and any inconsistencies will generate findings. Common mistakes first-time examinees make include: producing documents without a quality review (resulting in incomplete or disorganized productions that frustrate staff and extend the examination); becoming defensive during interviews rather than being forthcoming and professional; failing to request a reasonable extension when the production deadline is genuinely unachievable (most examination staff will grant a short extension for first-time examinees if asked promptly and with good reason); and neglecting to implement a document hold, resulting in the routine deletion of emails or records within the scope of the examination.

场景： 一家运营18个月、管理3.5亿美元客户资产的注册投资顾问收到首次SEC审查通知函。公司有4名员工：创始人/投资组合经理（同时担任指定CCO）、初级分析师、运营经理和行政助理。初始文件请求清单包含45个条目，涵盖合规政策、交易记录、广告材料、费用计算和网络安全文档。公司需在21个日历日内提交文件。CCO从未经历过监管审查。

合规问题：

新注册机构是SEC审查部的高优先级审查类别。审查人员将评估公司是否实际落实了Form ADV中描述的合规计划。
创始人同时担任投资组合经理和CCO的公司存在固有利益冲突——CCO监督的对象同时管理公司并做出投资决策。SEC审查人员将仔细审查合规职能是否真正独立且有效。
仅有4名员工，公司在继续正常运营的同时，管理45个条目文件请求的资源有限。
新注册机构的合规政策通常在注册时采用，但从未更新或调整以反映公司在最初18个月发展过程中的实际操作。

分析： CCO收到通知函后应立即采取以下步骤。首先，聘请具有SEC审查经验的外部合规律师或合规顾问——在没有经验丰富的指导下尝试应对首次审查会显著增加风险。其次，为每个IDR条目分配具体负责人，并设定明确的内部截止日期（比SEC截止日期至少提前5天，以便进行质量审查）。第三，快速进行自我评估：将公司书面合规政策与实际操作进行比较，识别任何重大漏洞。如果合规手册在注册时采用但此后未更新，这一漏洞将被审查人员发现，应主动确认。第四，为员工面试做准备——SEC几乎肯定会与CCO/创始人进行长时间访谈，涉及合规计划、费用计算、交易操作和广告。创始人应能清晰阐述公司的投资流程、合规控制，以及如何管理利益冲突（包括双重PM/CCO角色）。第五，审查公司Form ADV的准确性——审查人员将ADV披露内容与实际操作进行比较，任何不一致都会产生认定结果。首次接受审查的公司常犯的错误包括：未进行质量审查就提交文件（导致提交文件不完整或混乱，使审查人员受挫并延长审查时间）；面试时防御而非坦诚专业；当提交截止日期确实无法实现时，未请求合理延期（大多数审查人员会为首次接受审查的公司批准短期延期，只要及时提出并给出合理理由）；未实施文件保留措施，导致审查范围内的电子邮件或记录被常规删除。

Example 2: Deficiency letter with six findings requiring structured response

示例2：包含6项认定结果的缺陷函需结构化回复

Scenario: A mid-size investment adviser ($2 billion AUM, 30 employees) receives a deficiency letter from the SEC Division of Examinations following a routine examination. The letter identifies six deficiency findings: (1) custody rule violations — the adviser has inadvertent custody over three client accounts where it serves as trustee, but has not obtained a surprise examination or ensured independent verification under Rule 206(4)-2; (2) advertising compliance — the firm's website includes backtested performance for a model portfolio without required disclosures regarding methodology, assumptions, limitations, or risks, and without net performance alongside gross performance, in violation of Rule 206(4)-1; (3) incomplete books and records — the firm failed to retain business-related text messages exchanged between the portfolio manager and a broker-dealer counterparty, in violation of Rule 204-2; (4) code of ethics — two access persons failed to submit quarterly transaction reports for three consecutive quarters, and the firm had no process to identify or follow up on missing reports, in violation of Rule 204A-1; (5) annual compliance review — the firm's most recent annual review under Rule 206(4)-7 was a two-page summary that did not assess the adequacy of any specific policy or procedure; (6) cybersecurity — the firm had no written incident response plan and had not conducted a risk assessment of its information technology systems. The firm has 30 days to respond.

Compliance Issues:

Six findings spanning multiple compliance areas suggest systemic compliance program weaknesses rather than isolated lapses.
The custody rule violation is the most serious finding because it directly affects client asset safety. Failure to comply with Rule 206(4)-2 is an area where the SEC has historically pursued enforcement action.
The off-channel communications finding (failure to retain text messages) aligns with a major SEC enforcement priority — the Division of Enforcement has brought dozens of actions against firms for recordkeeping failures related to off-channel communications.
The inadequate annual compliance review finding suggests that the firm's overall compliance oversight is deficient, which undermines the credibility of the firm's compliance program as a whole.

Analysis: The firm should structure its response as follows. First, engage compliance counsel to assist in drafting the response — given the number and seriousness of the findings, professional guidance is important. Second, address each finding individually in the order presented in the deficiency letter. For each finding, the response should: acknowledge the finding (or explain the basis for disagreement, if applicable); describe the root cause; detail the specific corrective actions already taken; provide a timeline for any remaining remediation; and identify the responsible person.

For finding (1) (custody), the firm should immediately engage an independent public accountant to conduct the required surprise examination under Rule 206(4)-2(a)(4), or alternatively, ensure that the trustee accounts are subject to an annual audit by an independent public accountant with the results distributed to the beneficiaries. The response should confirm the engagement, provide the accountant's name, and state the expected completion date. For finding (2) (advertising), the firm should remove the non-compliant backtested performance from its website immediately and describe the process for revising the content to include net performance, methodology disclosures, risk and limitation disclosures, and audience access controls as required by Rule 206(4)-1. For finding (3) (books and records), the firm should implement an approved communication platform, deploy mobile device management technology to capture text messages, issue a revised communication policy prohibiting business communications through unapproved channels, and train all employees. For finding (4) (code of ethics), the firm should collect the missing quarterly transaction reports retroactively, implement an automated tracking system that flags missing reports and escalates to the CCO, and discipline or counsel the access persons who failed to file. For finding (5) (annual compliance review), the firm should engage an external compliance consultant to conduct a comprehensive annual review covering all required elements under Rule 206(4)-7, with the results documented in a detailed written report presented to management. For finding (6) (cybersecurity), the firm should engage an information security consultant to conduct a risk assessment and develop a written incident response plan, with testing scheduled within 90 days. The firm should prioritize the custody finding and the off-channel communications finding, as these carry the highest enforcement risk, and ensure that corrective actions for these items are completed — not merely planned — before submitting the response.

场景： 一家中等规模投资顾问（管理20亿美元资产，30名员工）在常规审查后收到SEC审查部的缺陷函。函件列出6项缺陷认定：(1) 托管规则违规——顾问在担任三个客户账户受托人时拥有无意托管权，但未按Rule 206(4)-2要求进行突击审查或确保独立验证；(2) 广告合规——公司网站包含模型投资组合的回测业绩，但未按Rule 206(4)-1要求披露方法、假设、限制或风险，且未同时展示净业绩和总业绩；(3) 账簿与记录不完整——公司未保留投资组合经理与经纪交易商对手方之间的业务相关短信，违反Rule 204-2；(4) 道德准则——两名访问人员连续三个季度未提交季度交易报告，公司无流程识别或跟进缺失报告，违反Rule 204A-1；(5) 年度合规审查——公司最近一次Rule 206(4)-7项下的年度审查是两页摘要，未评估任何特定政策或流程的充分性；(6) 网络安全——公司无书面事件响应计划，未对信息技术系统进行风险评估。公司需在30天内回复。

合规问题：

涵盖多个合规领域的6项认定结果表明存在系统性合规计划薄弱环节，而非孤立失误。
托管规则违规是最严重的认定结果，因为它直接影响客户资产安全。未遵守Rule 206(4)-2是SEC历来采取执法行动的领域。
非官方渠道通信认定结果（未保留短信）与SEC主要执法重点一致——执法部已对数十家公司提起非官方渠道通信记录保存失败的执法行动。
年度合规审查不足的认定结果表明公司整体合规监督存在缺陷，这削弱了公司合规计划的整体可信度。

分析： 公司应按以下方式构建回复。首先，聘请合规律师协助起草回复——鉴于认定结果的数量和严重性，专业指导很重要。其次，按缺陷函中列出的顺序逐一回应每个认定结果。对于每个认定结果，回复应：确认认定结果（如适用，解释不同意的依据）；描述根本原因；详细说明已采取的具体纠正措施；提供未完成整改的时间线；确定负责人。

对于认定结果(1)（托管），公司应立即聘请独立注册会计师按Rule 206(4)-2(a)(4)要求进行突击审查，或确保信托账户接受独立注册会计师的年度审计，审计结果分发给受益人。回复应确认委托事项，提供会计师姓名，并说明预计完成日期。对于认定结果(2)（广告），公司应立即从网站上移除不合规的回测业绩，并描述修订内容的流程，包括按Rule 206(4)-1要求添加净业绩、方法披露、风险和限制披露，以及受众访问控制。对于认定结果(3)（账簿与记录），公司应实施批准的通信平台，部署移动设备管理技术以捕获短信，发布修订后的通信政策，禁止通过未批准渠道进行业务通信，并对所有员工进行培训。对于认定结果(4)（道德准则），公司应追溯收集缺失的季度交易报告，实施自动跟踪系统，标记缺失报告并上报给CCO，并对未提交报告的访问人员进行纪律处分或指导。对于认定结果(5)（年度合规审查），公司应聘请外部合规顾问进行全面年度审查，涵盖Rule 206(4)-7要求的所有要素，结果记录在详细的书面报告中并提交给管理层。对于认定结果(6)（网络安全），公司应聘请信息安全顾问进行风险评估并制定书面事件响应计划，计划在90天内完成测试。公司应优先处理托管认定结果和非官方渠道通信认定结果，因为这些具有最高执法风险，并确保在提交回复前完成（而非仅计划）这些事项的纠正措施。

Example 3: CCO building the business case for a mock examination program

示例3：CCO为模拟审查计划构建业务案例

Scenario: The Chief Compliance Officer of a mid-size broker-dealer (150 registered representatives, 12 branch offices) wants to implement an annual mock examination program. The firm's last FINRA cycle examination, two years ago, resulted in a deficiency letter with findings in trade surveillance, communications supervision, and branch office inspection procedures. The CCO has proposed a budget of $75,000 for annual mock examinations (including external consultant fees) and has presented the proposal to the firm's executive committee. The CEO and head of sales view the program as unnecessary overhead, arguing that the firm "already has a compliance department" and that the prior deficiency findings were "minor." They have asked the CCO to justify the expenditure.

Compliance Issues:

The firm received deficiency findings in its last examination, which means the next FINRA examination will almost certainly include a review of whether those deficiencies were remediated effectively. Failure to demonstrate effective remediation increases the risk of escalation to formal enforcement.
FINRA's risk-based examination approach means that firms with prior deficiency findings may be examined more frequently and with greater intensity.
The firm's characterization of prior findings as "minor" is a red flag for compliance culture — deficiency findings should be taken seriously regardless of perceived severity.
Under FINRA Rules 3110 (Supervision) and 3120 (Supervisory Control System), the firm is required to test and verify its supervisory procedures. A mock examination program is an effective means of satisfying this obligation.

Analysis: The CCO should build the business case on three pillars: risk reduction, cost avoidance, and regulatory expectation. On risk reduction: the firm's prior deficiency findings create a heightened examination risk profile. FINRA will expect to see documented evidence that the firm identified the root causes of the deficiencies, implemented corrective actions, and tested the effectiveness of those actions. A mock examination program produces exactly this evidence. Without it, the firm enters its next examination unable to demonstrate that it has improved — and if the same deficiencies recur, the likelihood of formal enforcement action (fines, censure, individual sanctions) increases substantially. On cost avoidance: the $75,000 annual investment in mock examinations should be compared to the cost of regulatory enforcement. FINRA fines for supervisory failures regularly exceed $500,000 and can reach millions of dollars for larger firms. Beyond fines, enforcement actions generate legal fees (typically $200,000 to $1 million or more to defend a FINRA enforcement proceeding), reputational damage, increased E&O insurance premiums, and potential loss of clients. The mock examination program is a fraction of the cost of a single enforcement action. On regulatory expectation: both FINRA Rule 3120 (requiring an annual report by designated supervisory control persons certifying the adequacy of supervisory controls) and FINRA's examination priorities consistently emphasize the importance of testing supervisory systems. A mock examination program demonstrates to FINRA examiners that the firm takes its supervisory obligations seriously and proactively identifies and addresses issues.

For program design, the CCO should propose a proportionate program: conduct one comprehensive annual mock examination covering the highest-risk areas (selected based on FINRA's published examination priorities, the firm's prior deficiency history, and any new business activities), supplemented by targeted quarterly reviews of specific compliance functions. The annual mock exam should simulate a FINRA cycle examination, including a mock IDR, document production exercise, and interviews with branch managers and supervisory personnel. Engage an external compliance consultant with FINRA examination experience for the annual comprehensive exam to ensure objectivity and credibility. The quarterly targeted reviews can be conducted internally by the compliance team, focusing on areas such as communications supervision (one quarter), trade surveillance (another quarter), branch office inspections (another quarter), and AML/financial crimes (another quarter). This phased approach distributes the workload across the year and ensures continuous monitoring rather than a single point-in-time assessment. The CCO should present the mock examination results to the executive committee after each exercise, creating a documented record of management engagement with compliance findings — a factor that FINRA considers favorably during examinations.

场景： 一家中等规模经纪交易商（150名注册代表，12个分支机构）的首席合规官希望实施年度模拟审查计划。公司两年前的上一次FINRA周期审查导致缺陷函，涉及交易监控、通信监督和分支机构检查流程的认定结果。CCO提出7.5万美元的年度模拟审查预算（包括外部顾问费用），并向公司执行委员会提交了提案。CEO和销售主管认为该计划是不必要的开支，辩称公司“已有合规部门”，且先前的缺陷认定结果“无关紧要”。他们要求CCO证明该支出的合理性。

合规问题：

公司在上次审查中收到缺陷认定结果，这意味着下一次FINRA审查几乎肯定会包括对这些缺陷是否有效整改的审查。未能证明有效整改会增加升级为正式执法行动的风险。
FINRA基于风险的审查方法意味着有先前缺陷认定结果的公司可能更频繁、更严格地接受审查。
公司将先前认定结果描述为“无关紧要”是合规文化的警示信号——无论感知的严重程度如何，缺陷认定结果都应被认真对待。
根据FINRA Rule 3110（监督）和Rule 3120（监督控制系统），公司必须测试和验证其监督流程。模拟审查计划是满足该义务的有效手段。

分析： CCO应从三个方面构建业务案例：风险降低、成本规避和监管预期。在风险降低方面：公司先前的缺陷认定结果使其审查风险 profile 升高。FINRA将期望看到文件证据，证明公司已识别缺陷的根本原因、实施纠正措施，并测试这些措施的有效性。模拟审查计划恰好能提供此类证据。没有该计划，公司进入下一次审查时无法证明其已改进——如果相同缺陷再次出现，采取正式执法行动（罚款、谴责、个人制裁）的可能性大幅增加。在成本规避方面：每年7.5万美元的模拟审查投资应与监管执法成本进行比较。FINRA对监督失败的罚款通常超过50万美元，对大型公司可达数百万美元。除罚款外，执法行动还会产生法律费用（为FINRA执法程序辩护通常需20万至100万美元或更多）、声誉损害、职业责任保险保费增加，以及潜在客户流失。模拟审查计划的成本仅为单次执法行动的一小部分。在监管预期方面：FINRA Rule 3120（要求指定监督控制人员每年提交报告，证明监督控制的充分性）和FINRA审查重点一致强调测试监督系统的重要性。模拟审查计划向FINRA审查人员表明，公司认真对待其监督义务，并主动识别和解决问题。

在计划设计方面，CCO应提出一个相称的计划：每年进行一次全面模拟审查，涵盖最高风险领域（根据FINRA发布的审查重点、公司先前缺陷历史和任何新业务活动选择），辅以对特定合规职能的定向季度审查。年度模拟审查应模拟FINRA周期审查，包括模拟IDR、文件提交练习，以及与分支机构经理和监督人员的访谈。聘请具有FINRA审查经验的外部合规顾问进行年度全面审查，以确保客观性和可信度。季度定向审查可由合规团队内部进行，重点关注通信监督（一个季度）、交易监控（另一个季度）、分支机构检查（另一个季度）和反洗钱/金融犯罪（另一个季度）。这种分阶段方法将工作量分散到全年，并确保持续监控，而非单一时间点评估。CCO应在每次练习后向执行委员会提交模拟审查结果，创建管理层参与合规认定结果的记录——这是FINRA在审查中考虑的有利因素。

Common Pitfalls

常见陷阱

Treating examination preparation as a reactive exercise — scrambling to organize documents only after receiving a notification letter, rather than maintaining examination readiness as an ongoing practice.
Failing to read and act on SEC and FINRA annual examination priority letters, which are effectively advance notice of what regulators plan to focus on.
Producing documents to regulators without a quality review, resulting in incomplete, disorganized, or inadvertently privileged materials that extend the examination and create negative impressions.
Coaching interviewees to give scripted or evasive answers rather than preparing them to respond honestly and knowledgeably — examiners are experienced at detecting rehearsed responses, and evasiveness raises red flags.
Responding to deficiency letters with vague promises ("we will enhance our procedures") rather than specific, concrete corrective actions with assigned owners and completion dates.
Failing to conduct root cause analysis for deficiency findings, resulting in superficial fixes that do not address the underlying problem and lead to recurring findings in subsequent examinations.
Treating the annual compliance review under Rule 206(4)-7 as a check-the-box exercise rather than a genuine assessment of the compliance program — examiners can easily distinguish between a substantive review and a perfunctory one.
Allowing the CCO to be marginalized or under-resourced, which examiners will identify through interviews and organizational analysis as evidence of inadequate compliance culture.
Failing to implement a document hold upon receiving an examination notification, resulting in the destruction of potentially relevant records.
Not tracking and following up on remediation of prior deficiency findings — regulators will specifically review whether prior findings were addressed, and unresolved prior findings significantly increase enforcement risk.
Conducting mock examinations but failing to document findings and remediation, negating much of the program's value as evidence of proactive compliance.
Ignoring "informal" observations communicated at the exit conference or in a closing letter simply because they were not included in a formal deficiency letter — these observations frequently become formal findings in the next examination if not addressed.

将审查准备视为被动活动——仅在收到通知函后才匆忙整理文件，而非将审查准备作为持续实践。
未阅读并落实SEC和FINRA年度审查重点函，而这些函实际上是监管机构计划关注内容的提前通知。
未进行质量审查就向监管机构提交文件，导致提交文件不完整、混乱或意外提交享有特权的材料，延长审查时间并留下负面印象。
指导受访者给出脚本化或回避性答案，而非准备他们诚实、有知识地回应——审查人员有经验检测排练过的答案，回避会引发警示信号。
用模糊承诺（“我们将强化流程”）回应缺陷函，而非具体、明确的纠正措施，且未指定负责人和完成日期。
未对缺陷认定结果进行根本原因分析，导致表面修复未解决潜在问题，在后续审查中再次出现相同缺陷。
将Rule 206(4)-7项下的年度合规审查视为走形式，而非对合规计划的真正评估——审查人员可轻易区分实质性审查和敷衍了事的审查。
让CCO被边缘化或资源不足，审查人员会通过访谈和组织分析将其识别为合规文化不足的证据。
收到审查通知后未实施文件保留措施，导致潜在相关记录被销毁。
未跟踪和跟进先前缺陷认定结果的整改——监管机构会专门审查先前认定结果是否已解决，未解决的先前认定结果会显著增加执法风险。
进行模拟审查但未记录认定结果和整改，使该计划作为主动合规证据的价值大打折扣。
忽视退出会议或结案函中传达的“非正式”观察结果，仅仅因为它们未包含在正式缺陷函中——如果不解决，这些观察结果在下次审查中经常会成为正式认定结果。

Cross-References

交叉引用

books-and-records (Layer 9) — Records readiness is the foundation of examination readiness; the ability to produce complete, accurate, and well-organized records in response to document requests is the single most important factor in examination outcomes.
advertising-compliance (Layer 9) — Advertising and marketing materials are a top SEC and FINRA examination focus area; Marketing Rule compliance and FINRA Rule 2210 supervision are routinely reviewed.
privacy-data-security (Layer 9) — Cybersecurity is a recurring SEC examination priority; firms' information security programs, incident response plans, and vendor oversight are regularly examined.
anti-money-laundering (Layer 9) — AML program review is a standard component of FINRA examinations and an increasingly common focus of SEC examinations; AML independent testing reports and SAR filing practices are frequently requested.
conflicts-of-interest (Layer 9) — Conflict identification, disclosure, and management is examined closely in both SEC and FINRA examinations, particularly in the context of fee arrangements, compensation structures, and affiliated transactions.
client-disclosures (Layer 9) — Disclosure document completeness and accuracy (Form ADV, Form CRS, brochure supplements) are routinely reviewed; discrepancies between disclosures and actual practices are a common deficiency finding.
reg-bi (Layer 9) — Regulation Best Interest compliance is a current top examination priority for both the SEC and FINRA; examinations assess both written policies and actual recommendation practices.
sales-practices (Layer 9) — Supervision of sales practices, suitability determinations, and supervisory control systems are core FINRA examination areas under Rules 3110 and 3120.
fiduciary-standards (Layer 9) — Fiduciary duty compliance, including duty of care and duty of loyalty, is assessed during investment adviser examinations; the SEC's Fiduciary Interpretation provides the framework examiners apply.

books-and-records（层级9）——记录准备是审查准备的基础；响应文件请求时提交完整、准确、组织良好的记录是审查结果的最重要单一因素。
advertising-compliance（层级9）——广告和营销材料是SEC和FINRA审查的重点领域；营销规则合规和FINRA Rule 2210监督是常规审查内容。
privacy-data-security（层级9）——网络安全是SEC反复强调的审查重点；公司的信息安全计划、事件响应计划和供应商监督经常被审查。
anti-money-laundering（层级9）——反洗钱计划审查是FINRA审查的标准组成部分，也是SEC审查日益常见的重点；反洗钱独立测试报告和SAR提交操作经常被要求提供。
conflicts-of-interest（层级9）——利益冲突识别、披露和管理在SEC和FINRA审查中被密切审查，特别是在费用安排、薪酬结构和关联交易方面。
client-disclosures（层级9）——披露文件的完整性和准确性（Form ADV、Form CRS、手册补充）是常规审查内容；披露内容与实际操作之间的差异是常见的缺陷认定结果。
reg-bi（层级9）——最佳利益监管规则合规是SEC和FINRA当前的顶级审查重点；审查评估书面政策和实际推荐操作。
sales-practices（层级9）——销售实践监督、适当性认定和监督控制系统是FINRA Rule 3110和3120项下的核心审查领域。
fiduciary-standards（层级9）——受托责任合规，包括注意义务和忠诚义务，在投资顾问审查中被评估；SEC的受托解释为审查人员提供了应用框架。