Preparing your operations for an SEC examination

The document request list arrives and the firm spends three weeks assembling things it already has. That is the common experience, and it is worth being precise about what is going wrong, because it is usually not what people assume.

In most cases the firm is compliant. The policies exist, the reviews happened, the disclosures went out. What is missing is the ability to demonstrate it without a manual reconstruction.

The difference between having a record and producing one

A record that lives in somebody’s email, or in a file named by whoever saved it, or in a note that describes what was decided but not when or by whom, is a record you have. It is not a record you can produce on request in the form somebody asked for it.

The gap between those two states is entirely operational. It is naming conventions, retention applied consistently, an audit trail that shows what changed and who changed it, and a filing structure that somebody who did not file the document can search.

When compliance asks how something happened, the question is whether the system holds the trail or whether somebody has to rebuild it from email.

What to fix before you are asked

• One naming convention and one filing structure, with retention applied, so a document can be found by search rather than by memory
• An activity trail on the processes that touch client records, showing what changed, when, and who did it
• Named access rather than shared logins, with a register that says who has what
• Written procedures for the processes an examiner asks about, which are usually onboarding, money movement, and annual reviews

None of that is a compliance project. It is document architecture and workflow design, which is why it usually falls between the compliance consultant, who is not configuring your systems, and the software vendors, who are not responsible for how you use theirs. It is most of what a build covers.

The requests that cause the most trouble

Across firms, the same few items generate most of the scramble, and all of them are operational rather than legal:

• Producing every document relating to a named client across a date range, when files were named by whoever saved them
• Showing that an annual review actually happened, when the evidence is a calendar entry and somebody’s memory
• Demonstrating who had access to what, and when, without a maintained register
• Evidencing that a policy was followed rather than merely written, which requires a trail the policy never specified
• Explaining a gap, where the work was done correctly and nothing recorded that it was

Each of those is a document architecture or workflow question. None is answered by a better policy document, which is why firms with excellent compliance manuals still lose three weeks to a request list.

What to do in the two weeks after a request arrives

If the letter has already landed, the sequence that works is triage rather than repair. Take the request list and sort every item into three groups: what you can produce today, what exists but has to be assembled, and what was never recorded.

The third group is the one that needs a decision, and it needs it early. Reconstructing a record after the fact is a different activity to producing one, and it should be handled with your compliance counsel rather than quietly by whoever is assembling the folder.

The first two groups are a logistics problem. Assign one owner, work in the order the request list is written, and keep a log of what was sent and when, because follow-up requests are normal and the second round is much easier if the first was tracked.

You are the registrant

Whatever a vendor or an outside firm does for you, the recordkeeping obligation is yours, and everything built for your firm should sit inside your accounts and inside your examination record. That is the reason our own arrangement is structured the way it is. No environment of ours carries your data, access is named and revocable by you, and every configuration change is logged in a form your compliance people can read.

It is worth asking any operations vendor the same question, and asking it before you grant a login rather than during an exam.