The compliance year,
laid out in advance.
A working calendar of the recurring obligations an SEC-registered adviser carries — annual reviews, filings, deliveries, and the cybersecurity tasks that sit alongside them. Included in the BrainTrust library — the free tier starts with the Securing Compliance report.
A year of obligations
on one page
The calendar maps the compliance tasks that recur on a predictable schedule — so nothing is discovered late. It is organized to be dropped into a firm’s own workflow and adjusted to its fiscal calendar and service providers.
It is the same checklist structure we use when standing up a compliance program, with the cybersecurity tasks integrated rather than bolted on.
- Annual Rule 206(4)-7 compliance program review producing written findings, ADV delivery, and policy refresh.
- Periodic Regulatory filings and deliveries on their statutory schedule — the ADV annual updating amendment (due 90 days after fiscal year end) and the annual privacy notice delivery under Reg S-P — tracked so deadlines are met early.
- Recurring Cybersecurity tasks — access reviews, training, vendor due diligence, and incident response testing.
- Ongoing Books and records retention under Rule 204-2 and documentation of supervisory review.
A quarter-by-quarter walk
through the compliance year
The walk below assumes a December 31 fiscal year end, because most firms have one. The statutory deadlines move with your fiscal calendar; everything else is scheduled by the firm. What matters is not which quarter a task lands in — it is that each task has a date, an owner, and a record when it is done.
Q1 — Filings and the baseline
The quarter opens with the one hard statutory deadline on this page: the Form ADV annual updating amendment, due within 90 days of fiscal year end under Advisers Act Rule 204-1 — end of March for a calendar-year firm. Alongside it sits the annual Regulation S-P privacy notice, delivered when required: firms that do not share nonpublic personal information in ways that trigger opt-out rights, and whose practices have not changed, may qualify for the statutory exception — but that determination should be made and documented each year, not assumed. Q1 is also a natural point for the first access-rights review of the year — confirming that every account, permission, and administrative role still belongs to a current employee who needs it. The review itself is scheduled by the firm; the record it produces supports the safeguards obligation under Reg S-P (17 CFR 248.30).
Q2 — Risk and the vendors
Mid-year is where the assessment work fits. The periodic risk assessment refresh — what changed since last year: systems, staff, service providers, data flows — is the factual foundation the Rule 206(4)-7 program rests on, and the amended Reg S-P incident response program expects the same understanding of where customer information lives. It pairs naturally with the vendor due-diligence re-review: amended Reg S-P requires written oversight procedures for service providers with access to customer information, including notification expectations, and a periodic re-review cycle — on a schedule set by the firm — is how that oversight stays current rather than a one-time onboarding file. Security awareness training also runs on a recurring cadence; no SEC rule mandates a specific frequency, so this is best practice rather than requirement — but dated completion records are among the first things an examiner asks for.
Q3 — Testing and the board
The third quarter is a sensible slot for the incident response plan tabletop — a walked-through scenario with the people who would actually respond. The exercise itself is best practice, not a rule mandate, but it is the clearest way to demonstrate that the incident response program amended Reg S-P requires (17 CFR 248.30) is a working program rather than a document. Firms subject to Regulation S-ID owe an annual report on the identity theft prevention program to the board or designated senior management (17 CFR 248.201) — the rule requires it at least annually, on a date scheduled by the firm. Close the quarter with a books-and-records checkpoint: confirm the year's cybersecurity records — reviews, training logs, vendor files, incident documentation — are being retained where Rule 204-2 expects to find them.
Q4 — The annual review
Everything above feeds the Rule 206(4)-7 annual review — the written assessment of whether the firm's compliance policies and procedures are adequate and working. Its cybersecurity component is not a separate exercise; it is the year's evidence read together: the access reviews, the training records, the vendor re-reviews, the tabletop findings, the risk assessment. Where that reading surfaces gaps, Q4 is when the policy refresh happens, so the new year starts on current documents. Firms that run access-rights reviews semiannually — a cadence scheduled by the firm — place the second pass here as well.
None of this is exotic. It is ten or so recurring tasks, each anchored to a rule or honestly labeled best practice, distributed across four quarters so that no single month carries the whole program — and so that when an examination request arrives, the answer is a file that already exists.
The calendar this page describes is in the BrainTrust.
The annual compliance calendar lives in the BrainTrust library alongside the policies, checklists, and examination templates it schedules — each mapped to the rule it supports. The free tier starts with the Securing Compliance report, no payment required.
The calendar tells you what’s due.
We make sure it gets done.
A continuous engagement keeps every item on this calendar current and documented, so an examination request is answered from records that already exist.
View services