The Deficiency Letter and the Response Expected

At the close of an examination the staff ordinarily issues a written communication. Where nothing significant was observed, the letter says the examination is concluded. Where something was observed, the letter lists the deficiencies, identifies the rule implicated by each, and asks for a written response within a stated period. The document is not an adjudication and does not establish that a violation occurred, but it is the record against which the firm's next examination will be read.

What the letter contains

The structure is consistent. Each observation is stated in a short paragraph describing what the staff found in the firm's own records, followed by a citation to the provision the observation implicates and a statement of what the rule requires. The letter usually distinguishes between deficiencies, which are observations of noncompliance, and weaknesses or suggestions, which are observations about a control that functioned but could function better.

The ordering is not accidental. Items placed first generally reflect the staff's assessment of significance, and observations that touch client assets, disclosure accuracy or the integrity of records appear ahead of documentation points. A letter that opens with the compliance program itself, rather than with a discrete practice, signals a broader concern than the individual items might suggest.

What the letter does not contain is a demand. It requests a response and identifies a date. It does not order remediation, does not impose a penalty, and does not require an admission. That absence sometimes leads firms to treat the letter as advisory, which is a mistake: the response is voluntary in form and expected in substance, and a firm that does not answer has created the first fact in a subsequent record.

Drafting the response

A useful response is organized item by item, in the order the letter used, with each observation addressed in turn. For each, three things belong in the answer: what the firm has done or will do, who is accountable for it, and by what date it is or will be complete. Where a change is already made, the date and the evidence should be stated. Where a change is planned, the plan should be specific enough that the staff could test it at the next examination.

Two habits weaken responses. The first is quoting the policy that was not followed, which addresses the wrong problem, since the observation was that practice diverged from the policy. The second is describing an intention without an owner or a deadline, which reads as an aspiration. A short response that commits to a concrete change on a stated date is stronger than a long one that explains the firm's philosophy.

Tone is a smaller matter than firms suppose but not an irrelevant one. The staff reads a large number of these responses, and the ones that are remembered are the ones that are precise. A response that concedes what is accurate, corrects what is not, and commits to specific work is read as a functioning compliance program describing itself. A response drafted primarily to preserve litigation positions is read as something else.

What escalates a letter

Most examinations end with a letter and a response. A minority move further, and the factors that push them there are reasonably predictable. Repetition is the strongest. An observation that appeared in a prior letter, was answered with a commitment, and reappears is treated as a failure of the compliance function rather than as an isolated lapse, and it is difficult to explain in a way that does not concede the point.

Client harm is the second. A deficiency that caused clients to pay fees they did not owe, to hold assets that were misdescribed, or to lose access to their property is qualitatively different from a documentation gap. The third is misstatement: inaccurate information given to the staff, records altered after a request, or a response that is contradicted by the firm's own documents. That category converts a compliance matter into a candidate for enforcement almost regardless of the underlying issue.

None of the three escalation factors depends on the size of the firm. A small adviser with a repeat recordkeeping deficiency is in a worse position than a large one with a novel issue it identified and reported itself. Self-identification is the countervailing factor: a firm that found a problem before the staff did, disclosed it, and remediated it is generally treated as demonstrating that the program works rather than that it failed.

After the response

The staff may accept the response and close the examination, may ask follow-up questions, or may schedule a further review to test the remediation. Closure is communicated in writing in most cases, and firms should retain both the letter and the response with the compliance records, since the next examination team will read them before the fieldwork begins.

Where the matter is referred, the process changes character. Enforcement staff conduct an investigation with subpoena power rather than an inspection, the firm's cooperation becomes a matter of legal obligation rather than practice, and the possible outcomes include a cease-and-desist proceeding, an administrative proceeding against the firm or individuals, or a civil action. The mechanics of resolving such a matter are set out in settling an enforcement action.

Firms that come through the process well generally treat the letter as the beginning of a compliance cycle rather than the end of an examination. The annual review required by rule is the natural place to test whether the commitments made in the response are still operating, and the records that demonstrate it are the ones described in books and records and how long they are kept. The inspection that produced the letter is described in the examination and what is requested, and disclosure items commonly cited in these letters are covered in the disclosure brochure and its annual update.