Introduction
The SEC's Division of Examinations has outlined its fiscal year 2027 examination priorities. While this staff statement doesn't create new obligations, it highlights key areas of focus: conflicts of interest, supervision, oversight of AI, cybersecurity, and vendor risk.
The common theme is evidence. Examiners want to see if your policies are well-designed, implemented, and provable. This checklist offers eight reviews to conduct before you're asked. Each has a clear done/not-done state and a description of what "good" looks like.
Prerequisites
Before you begin, gather these essentials:
- A named owner for each area. Assign one accountable person for conflicts, AI, cybersecurity, vendors, and disclosures.
- Access to your records. You'll need supervisory review logs, escalation files, vendor files, and incident response plans.
- A retrieval test. Select one example from each area and time how long it takes to retrieve. Slow retrieval could become an issue.
Checklist
1. Re-test conflict-of-interest policies against current operations.
Done when: you've compared written policies to current activities, including any growth, new services, or acquisitions since the last review. Not done if the policies predate these changes.
What good looks like: Each policy maps to a control that actively functions, and you can show a recent example of that control resolving a conflict.
2. Evaluate reliance on information barriers for conflict controls.
Done when: you've assessed whether access controls and ethical walls are the sole safeguards for firms with multiple business lines.
What good looks like: Barriers are complemented by monitoring, exception reporting, and documented follow-up.
3. Review compensation incentives and account-selection decisions.
Done when: for dual registrants, you've examined how brokerage versus advisory account decisions are made and whether compensation structures create pressure.
What good looks like: Account-selection rationale is documented at the decision time, and compensation-related conflicts are disclosed and mitigated under Regulation Best Interest where applicable.
4. Build and maintain an AI tool inventory.
Done when: you have a current list of AI tools used in compliance, trading, AML, fraud detection, and client-facing work. Include tools employees adopted independently, like ChatGPT.
What good looks like: Each entry shows an owner, data inputs, how outputs are validated and monitored, and the escalation path. An approved-tools list and usage policy exist, and a documented decision specifies which AI interactions are records.
5. Document review processes for AI-assisted work.
Done when: a named person reviews AI-assisted output, and the review leaves a trace. Also, ensure any statements about automated tools in marketing or disclosures are accurate.
What good looks like: A reviewer can show what the tool produced, what changed, and who signed off.
6. Pressure-test incident response against Regulation S-P.
Done when: your plan addresses unauthorized access to customer information, customer notification, and service-provider responsibilities. Confirm coverage for ransomware, Regulation S-ID identity theft red flags, and AI-enabled threats like deepfake voice and video.
What good looks like: You've run the plan through a tabletop exercise, assigned roles by name, and recorded what you learned and fixed.
7. Refresh due diligence files for critical vendors.
Done when: each critical provider has a file showing how you evaluated it and how you monitor it.
What good looks like: The file is current, shows ongoing monitoring rather than a one-time onboarding review, and records how issues were raised and resolved.
8. Align marketing, recommendation, and disclosure reviews.
Done when: reviews of marketing materials, recommendations, and disclosures (including Form CRS content on services, fees, conflicts, and disciplinary history) are documented and match what investors were told.
What good looks like: You can quickly answer three questions for any item: what did the investor see, who reviewed it, and how were concerns resolved?
Common Mistakes
- Treating the policy as the proof. A well-written conflicts policy shows design, not implementation. Examiners test how controls operate, not how policies read.
- Ignoring shadow AI. If you only inventory vendor-approved tools, you'll miss those that matter most for data exposure and recordkeeping.
- Letting vendor files go stale. A due diligence file from onboarding day doesn't demonstrate oversight.
- Documenting reviews in ways that are slow to retrieve. If a supervisory review takes days to reconstruct, the control appears weaker than it is.
- Running one big annual review. Evidence builds through routine, dated, retrievable records, not a scramble before an exam.
Next Steps
Start with the area closest to your firm's business. If you're a dual registrant, begin with items 1 through 3. If you rely heavily on technology vendors, start with items 6 and 7.
Then run the retrieval test from the prerequisites on every area. Where you can't produce evidence quickly, that's your first remediation priority.
Finally, review the SEC Exam Handbook, which describes each stage of an examination, so your team knows what to expect and can produce records efficiently. Watch for upcoming risk alerts and exam observations too; they'll show where firms are falling short.
You don't need to overhaul your program. You need to be able to show it works.
