What an SEC Exam Actually Tests, Versus a SOX Audit

If a registered RIA has custody of client assets, directly holding funds or securities or having the authority to move them, SEC Rule 206(4)-2 generally requires an annual surprise examination by an independent public accountant (with exceptions, such as custody solely from fee-deduction authority), a very different process from a financial statement audit. Most advisory firms structure themselves specifically to avoid custody, using a qualified third-party custodian for client accounts, precisely to sidestep that heavier compliance burden.

Confirm with securities counsel exactly which of the firm's activities, including any authority to deduct fees directly from client accounts, might trigger custody rule obligations, since the answer changes what kind of audit and controls actually apply, well before either FloQast or AuditBoard becomes relevant.

Advisory fees billed based on assets under management, whether in advance or in arrears, have to tie precisely to the fee schedule in each client's agreement and to the actual AUM balance on the billing date. A fee calculated off a stale balance, or a tiered fee schedule applied incorrectly as a client's AUM crosses a breakpoint, is exactly the kind of error an SEC examiner samples directly.

Reconciling billed fees against the client agreement and the AUM snapshot used to calculate them, every billing cycle, is close-process work, and it's the kind of repeatable check close management software handles well: standardizing the template and enforcing a reviewer other than whoever manages that client relationship.

Check each billing cycle for these fee reconciliation points:

• Confirm the fee rate applied matches the schedule in each client's agreement, including any tiered structure that steps down as assets grow.
• Tie the assets under management balance used for billing to the actual balance on the billing date, not a stale prior figure.
• Flag any account that crossed a fee breakpoint since the last cycle and confirm the calculation was updated to reflect it.
• Document who reviewed the billing run and how any variance was explained, so an examiner can follow the trail.
• Reconcile advance and arrears billing separately so timing differences do not hide an overbilling pattern.

Separate from fee billing, SEC exams also probe the firm's documented policies and procedures, the ones required under the Advisers Act's compliance rule, covering everything from trade allocation to advertising claims to how conflicts of interest get disclosed. A firm can bill fees perfectly and still draw a deficiency letter if its policies exist on paper but aren't demonstrably followed.

A GRC platform is useful here mainly for larger, multi-strategy advisors that need to map policies to specific business activities and evidence that testing actually happened on schedule, rather than relying on the chief compliance officer's memory that a review took place.

Picture a client whose account grows past the AUM level where the fee schedule steps down to a lower tier, but the billing system keeps charging the prior, higher tier because nobody updated the calculation when the account crossed the threshold. Over several quarters, that's a real overbilling that a client, or an examiner sampling billing records, will eventually catch.

A reconciliation that recalculates the applicable tier against actual AUM every billing cycle, rather than assuming last period's tier still applies, catches this the same cycle it happens, letting the firm correct and, if needed, refund the client proactively rather than explaining an overbilling pattern to an examiner months later.

If the firm's last exam or internal review flagged fee calculation errors or billing that doesn't tie to client agreements, fix that first with close management software; it's the discipline protecting the firm from the most common and most damaging kind of finding. If the firm is scaling into a multi-strategy or institutional business with a larger compliance team, a GRC platform helps organize policy testing and evidence across more activities than one compliance officer can track manually.

Either way, confirm custody status and required policies with securities counsel first. Those determine which controls actually matter before any software decision does.

Beyond fee billing, SEC exams also review whether the firm's code of ethics is actually followed: personal securities trades by advisory staff reported and reviewed against client holdings, gifts and outside business activities disclosed, and conflicts described in Form ADV matching how the firm actually operates day to day. A firm can bill fees flawlessly and still draw a deficiency if its Form ADV describes a review process nobody is actually performing.

Treat code-of-ethics attestations and personal trading reviews as a recurring compliance task with its own documented cadence, not an annual formality, since that consistency is exactly what an examiner checks for when comparing disclosed policy to actual practice.