Exam Deficiencies: Understand What Examiners Want Fixed
What could be worse than spending time and money fixing the wrong problem because you misunderstood a deficiency listed by examiners? Answer: Having the examiners revisit and finding the problem they were concerned about not fixed.
That could lead to being treated as a "recidivist" firm, a list no adviser wants to be on. At a minimum, it could mean increased attention from the SEC. It could also mean the beginning of an enforcement action.
Most SEC deficiency write-ups are clear and precise, such as failing to document the review of a marketing letter, or that a firm’s code of ethics did not require employees to include the principal amount of holdings in initial and annual holdings reports, as required by Advisers Act Rule 204A-1.
Others, however, may be more open to interpretation, such as in these situations:
Lack of sufficient detail. The deficiency letter received after the examination lists one or more deficiencies that are imprecise. "There are some where there are questions as to how they should be addressed," said Sidley Austin partner Mark Borrelli. One example would be a deficiency stating that a firm’s disclosure was inadequate, but doesn’t specify in what way.
Inconsistency. A written deficiency which differs in meaning from what the examiners said in the exit interview at the end of the examination.
Misunderstanding by the firm. The compliance department believes a deficiency’s meaning is clear, but either misunderstands what the examiners wanted, or the examiners worded the deficiency badly. "You think you know what to do, but you don’t," said Morgan Lewis partner John McGuire.
What to do
Avoid the tragedy of making a good faith effort to fix a discrepancy only to find that the fix didn’t resolve the problem that examiners wanted addressed. Consider these best practices:
Contact the OCIE staff. After reading the deficiency letter, make a phone call to the OCIE staff to discuss any deficiencies that do not seem clear. "You could do that without actually admitting there is a deficiency," Borrelli said, simply by stating, "’We don’t actually agree that there is a deficiency, but we want to address your concerns,’" and then run ideas by the examiner to at least get some general guidance. Try to speak to a member of the exam team that visited your firm, he said.
Put your planned responses to the deficiency in your firm’s written response letter. Don’t expect OCIE to opine on your proposed fixes, Borrelli said, but you will be on the record as having told the SEC staff what you plan to do. "If the examiners come back, it would be hard for them to argue that you were acting in bad faith," he said.
Review deficiency fixes. The best way to do this would be to hire a third party, such as a consultant or a law firm with OCIE examination experience, to go over each deficiency and how the firm responded to it, said McGuire. Third parties can be expensive, however, so another option would be to perform the review yourself. Wait a year to put some distance between the fix and the review of the fix, and then check each one to make sure it resolved the problem noted by examiners. For smaller firms, the chief compliance officer can perform the review, he said, but larger firms may want to create a team, including the CCO, the general counsel and, if circumstances warrant, someone from accounting. It is also very important to ensure that the "fix" stays "fixed," said ACA Compliance Group senior principal consultant Vicki Hulick. "Since business practices often evolve over time, any review should confirm that the way the firm represented to the SEC that it would fix a noted deficiency is still being followed and any deviations documented and evaluated."
Document all the fixes your firm made. This provides evidence that you acted on them, which also demonstrates good faith. Some firms prepare a spread sheet and list the deficiencies, along with the steps taken to address them, Borrelli said. "Good faith efforts, even on unclear deficiencies, can make the difference between receiving another deficiency and an enforcement action." It is important that this documentation also states not only who is responsible for making the fix, but a target date for completion and a date that the fix was confirmed as completed, Hulick said.
Don’t let the exit interview pass without clarity. "There should be a discussion of all the deficiencies and you should make sure that you understand the staff’s position on all of them, even if you don’t agree with it," Borrelli said. That said, be aware that the deficiency letter you later receive may not match what you were told in the exit interview, so read it carefully for consistency. Hulick noted that SEC staff generally say during exit interviews that the findings are preliminary and that any actual write-ups may be different once they have completed their analysis offsite. "Registrants should never presume that the letter will say exactly the same thing as what they were told during an exit interview," she said. "In fact, for a few years the staff largely stopped giving exit interviews as a general practice, which some conjectured may have been because registrants complained that the deficiency letters contained different or additional write-ups that weren’t discussed during the exits, despite the warning that the findings discussed during the exit interview were preliminary."
Pay attention to whether OCIE lists deficiencies or best practices. This can make the difference between a requirement and a suggestion, McGuire said. OCIE’s choice of words is intentional, as there are some solutions it would like to see taken that are not requirements. In that case, a firm may "make a business decision that it is not going to do what the SEC is asking for," he said. The firm may believe that fixing a problem another way is sufficient, and changing the fix to match the letter’s suggestion "would take unnecessary time and resources." Of course, the risk the firm takes in doing so "is that the firm’s solution ends up being a compliance problem and it wasn’t doing it the way the SEC suggested. The SEC comes back and says, ‘You ignored us,’ which is not a good thing to hear from the SEC."
The return visit
How likely are examiners to come back in the next year or two? Not that likely, said McGuire, given the agency’s limited budget and other priorities, such as examining firms that have never before been examined, and its risk-based approach to deciding which firms to examine.
On the other hand, if a firm’s initial examination does not go well – if the deficiency letter received by the firm contains, say, 26 pages of deficiencies or several deficiencies that rise above the level of being technical or less material violations of the rules – "the odds of the SEC placing you on a list and coming back in only a few years goes up," McGuire said.
These follow-up examinations are what the staff refers to as CARs – Corrective Action Reviews – and, Hulick said, "These examinations definitely do happen."