An SEC examination does not begin when a firm receives its first document request. The ability to respond depends on work already done: keeping filings accurate, maintaining accessible records, understanding where risks arise in the business, and documenting how compliance issues are addressed.
On October 1, 2026, the SEC Division of Examinations published The SEC Exam Handbook: A Practical Guide on Process and Engagement. The handbook replaces and expands on the Division’s previous examination brochure, taking registrants through the process from candidate selection to the disposition letter. It does not create new requirements. Instead, it gives firms a more detailed account of how examinations are conducted and what the Division expects from both its staff and registrants.
For investment advisers, broker-dealers, and other registered entities, that visibility offers an opportunity to assess a practical question: Could we clearly demonstrate how our compliance program works if examiners asked us to do so today?
Risk-based selection makes firm-specific readiness essential
The handbook confirms that the Division uses a risk-based examination approach. Its assessment may consider prior examination history, supervisory concerns, tips or complaints, time since registration or the last exam, a firm’s client base, products and services, changes in key personnel, and information in regulatory filings. The SEC also notes that selection for an examination does not, by itself, indicate misconduct.
The Division’s 2026 Examination Priorities provide a separate view of topics it plans to focus on, including advisers’ fiduciary obligations and compliance programs, broker-dealer practices, and risks affecting multiple types of market participants. But the priorities are not an exhaustive list or a substitute for assessing a firm’s own operations. The 2027 Examination Priorities have not yet been released but are expected in the next month or so.
That distinction matters. A firm may know the SEC’s published priorities yet still struggle to explain how its controls address a newly introduced product, a change in business model, or a conflict arising from its particular activities. Examination preparation is therefore most useful when it connects the firm’s actual risks to its policies, supervision, testing, and supporting records.
The first request is a test of operational readiness
Most examinations begin with a call to the chief compliance officer or another regulatory contact, followed by a formal notice and an initial information request. The handbook says the SEC expects records to be available to staff within 24 hours in most circumstances, although staff usually provides two weeks to produce records in response to the initial request. Supplemental requests may follow, with response times varying according to the request.
For compliance teams, the challenge is not simply whether a record exists. It is whether the right people can find it, confirm that it is responsive, and produce it in the requested format. The handbook encourages firms to raise questions or concerns about requests promptly and says staff may grant reasonable extensions or permit rolling productions where appropriate.
This is a useful point for firms to examine their internal handoffs. If records sit across compliance, legal, operations, and supervisory teams, who coordinates the response? How does the firm track what has been requested, produced, or left outstanding? The handbook’s emphasis on complete, organized production makes those operational details relevant well before an exam is announced.
Examiners may look beyond the firm’s own records
The examination process can include more than information supplied directly by the registrant. The handbook states that staff may request relevant information from custodians, administrators, auditors, and other third-party service providers or agents. Staff may also contact clients, customers, or other knowledgeable people to gather or verify information.
This does not establish a new vendor-oversight requirement. It does underscore why firms should understand how information held by third parties relates to their own records and representations. When an outside provider plays a role in a process under examination, the firm should be able to explain that relationship accurately and identify the documentation relevant to it.
Communication continues throughout the examination
The handbook describes examinations as an ongoing exchange, not a single request followed by a final letter. Staff may interview personnel, visit a firm’s premises, discuss outstanding requests, and raise potential findings during the review. The SEC encourages registrants to explain relevant changes and actions taken or planned to address issues. It also asks firms to flag misunderstandings about their policies or practices as early as possible.
That creates an important role for people who know how the business actually operates. A policy may describe a control, but examiners may also need to understand who performs it, how exceptions are handled, and what records show it took place. Preparing knowledgeable personnel to explain those details can help make the discussion more productive.
The handbook also includes a specific caution for virtual interviews: SEC staff says it does not consent to recording, transcription, AI notetaking tools, or similar technologies during those meetings. Firms should account for that instruction when preparing participants for an examination interview.
Findings require a documented response
After staff completes its interviews and analysis, it typically holds an exit conference to discuss identified issues, if any. The SEC says it generally requests that senior management or board members attend. The conference gives the firm an opportunity to provide additional relevant information, correct inaccuracies, and discuss actions already taken or planned.
An examination may conclude without findings, but the handbook says most conclude with a deficiency letter. Such a letter identifies potential violations or other findings within the exam’s scope and requests a written response describing steps taken or planned to address them and prevent recurrence. The SEC says it typically requests that response within 30 days of the letter’s date. If staff has further comments, it strives to provide them within 60 days of the firm’s response or contact the firm about when written comments can be expected.
These details reinforce the value of tracking corrective action beyond the initial response. A firm needs a clear account of the issue, the action it committed to take, its progress, and the evidence supporting completion. Just as importantly, the handbook cautions that a lack of further staff comment should not be interpreted as SEC concurrence with the firm’s response.
Turning transparency into preparedness
The handbook is best read alongside the SEC’s annual examination priorities and Risk Alerts. The handbook explains how an examination generally proceeds; the priorities and alerts offer additional insight into topics and observations that may inform a firm’s compliance review. None replaces an assessment of the firm’s own obligations and circumstances.
For compliance leaders, a practical review could begin with five questions:
- Do our filings and public-facing descriptions accurately reflect how the business operates?
- Can we locate and produce records across the teams and third parties involved in a process?
- Can personnel explain how key supervisory and compliance controls work in practice?
- Do we have a reliable way to track examiner requests, responses, and open questions?
- Can we show what we did to address an identified issue and prevent its recurrence?
The SEC’s new handbook does not change the rules. It does make the examination process more visible, including the points where preparation, documentation, and clear communication matter most. Firms that use that visibility to test their own readiness will be better positioned to explain their compliance practices when examiners come calling.
About RegEd
RegEd is the market-leading provider of RegTech enterprise solutions with relationships with more than 200 enterprise clients, including 80% of the top 25 financial services firms.
Established in 2000 by former regulators, the company is recognized for continuous regulatory technology innovation with solutions hallmarked by workflow-directed processes, data integration, regulatory intelligence, automated validations, business process automation and compliance dashboards. The aggregate drives the highest levels of operational efficiency and enables our clients to cost-effectively comply with regulations and continuously mitigate risk.
Trusted by the nation’s top financial services firms, RegEd’s proven, holistic approach to RegTech meets firms where they are on the compliance and risk management continuum, scaling as their needs evolve and amplifying the value proposition delivered to clients. For more information, please visit www.reged.com.