Products / ExamReady & KYR
Know your regulator before the examination.
A good compliance program is not enough for a good examination. You need to know what your regulator is focused on, what it is finding at firms like yours, and what it asks a program like yours to show. ExamReady brings regulatory intelligence, a review of your program, a realistic examination and individual preparation of the people who will face the regulator into one engagement.
Who it’s for
For firms with an exam or inspection on the calendar, or overdue for one.
- A firm notified of an upcoming examination or inspection, or in a cycle where one is expected.
- A newly licensed business that has never been examined and does not know what the day looks like.
- A compliance team that knows the program but has never had to defend it out loud to an examiner.
- A compliance officer who wants an independent view of the program before the board asks for one.
- A firm that wants support during the examination itself, not only before it.
What you get
What you receive.
The goal is not perfection. No program is perfect. The goal is to know, before the examination, where the policies, the controls, the way the business actually runs and the evidence behind them do not line up, and what to do about each one. For every significant issue you get:
What we found
The issue, stated plainly, with the evidence we looked at.
Why it matters
The requirement or expectation it touches, and how an examiner is likely to weigh it.
What the regulator may ask
The questions the issue invites, so nobody hears them for the first time in the interview.
What evidence exists
What you can show today, and what is missing.
What to fix before the examination
The changes that can be made in the time available, with owners and dates.
What needs longer remediation
The issues that need a structured plan, and how to present that plan to the regulator.
How to manage what cannot be fixed in time
How to describe the issue, the plan and the interim controls honestly and without alarm.
The heat map
One page that shows where the exposure is, ordered by what to fix first.
Options
ExamReady Live: before, during and after.
Preparation is the beginning. ExamReady can stay with your team from the first document request to the last finding.
Before
- Regulatory intelligence
- Program review
- Mock examination or inspection
- Priority remediation
- Interview preparation
- Examination strategy
During
- Document request management
- Response review before it goes out
- Interview preparation, person by person
- Daily examination debriefs
- Emerging issue analysis
- Regulatory correspondence
- Management support
After
- Exit meeting preparation
- Findings analysis
- The regulatory response
- Remediation planning
- Follow-up support
- Closure
Know Your Regulator
We study your regulator before we examine you.
Rules are only part of the picture. We read current examination and inspection priorities, recent findings, enforcement actions, publications, speeches and proposed rules, and we look at what is happening to firms with a license, a product and a customer base like yours. Then we bring it together with your own regulatory profile: license, business model, products, customers, geography, history and risk. We do not prepare you for an examination in theory. We prepare you for your regulator.
What they are asking
Current examination themes, supervisory priorities and the areas receiving more attention this cycle.
What they are finding
Recent deficiencies, enforcement actions and remediation themes, which show where regulators keep seeing the same problem.
What your peers are seeing
Your firm is not examined in isolation. What regulators are challenging at businesses with similar licenses, products, customers and operating models is a chance to look at the same issue in your own firm first.
What is coming
Proposed rules, regulatory statements, emerging risks, technology developments and changes in supervisory practice that may shape the next examination.
Your regulatory profile
All of it read against your license, business model, products, customers, geography, regulatory history and risk profile.
The first SEC examination
First SEC examination preparation for newly registered advisers.
For investment advisers registered with the SEC that have not yet been examined. The SEC’s examination staff has said that for several years it has prioritized examining newly registered advisers within a reasonable period of time after registration becomes effective. ExamReady rehearses that first examination on the firm’s own program, practices and records.
What ExamReady provides
A review of your program, a mock examination, and preparation of the people who may face the examiner.
What these examinations involve
The SEC staff describe examinations of newly registered advisers as typically involving document requests and interviews with advisory personnel, covering the adviser’s business and investment activities, organizational affiliations, compliance policies and procedures, and disclosures to clients. Source: SEC Division of Examinations, Risk Alert, Observations from Examinations of Newly-Registered Advisers (March 27, 2023), https://www.sec.gov/files/risk-alert-newly-registered-ias-032723.pdf
What the first request covers
The staff’s typical initial request covers general information about the business, the compliance risks the firm has identified and the policies that address each one, information to test advisory trading, and information for the staff’s own compliance testing. The staff say the scope of an examination, and so the documents requested, vary with the firm’s business model, its risks and the reason for the examination. The staff’s attached request list describes a typical examination of an adviser without additional activities or relationships, such as managing private funds. A fund manager should not treat it as complete. Source: SEC Division of Examinations, Risk Alert, Investment Advisers: Assessing Risks, Scoping Examinations, and Requesting Documents (September 6, 2023), https://www.sec.gov/files/risk-alert-ia-risk-and-requesting-documents-090623.pdf
The annual review
Rule 206(4)-7 under the Advisers Act requires a review, no less frequently than annually, of the adequacy of the policies and procedures and the effectiveness of their implementation. Source: 17 CFR 275.206(4)-7(b), https://www.ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-7
What we review
Policies, procedures, governance and controls; how they are implemented; how the business actually runs; and the testing, records and approvals that show it. We look for the places where the written program, the practice and the evidence do not tell the same story.
Who we prepare
Everyone who may face the examiner: compliance leadership, senior management, operations, the front office and board members where relevant.
Staff guidance
Both risk alerts are statements of SEC staff. They have no legal force or effect, do not alter or amend applicable law, and create no new or additional obligations.
One finding, illustrated
What a finding looks like. The firm and the facts are invented.
This example is illustrative. It describes a fictional adviser, registered with the SEC for just over a year and never examined.
What we found
The memo for the firm’s first annual review lists the policies that were read. It does not record whether or how any area was tested, the compliance matters that arose during the year, or a conclusion on whether the policies were effective in practice.
Why it matters
Rule 206(4)-7(b) requires the review to consider both the adequacy of the policies and procedures and the effectiveness of their implementation. A memo that records only which policies were read does not show the second part.
What the regulator may ask
How did the review assess whether the policies worked in practice? What did it find? What changed as a result?
What evidence exists
The review memo, the compliance manual and its revision history, the compliance calendar, and the records of the business activity the policies cover.
What is missing
Any record of how effectiveness was assessed, and of the compliance matters and business changes the review took into account.
What to fix before the examination
Keep the original memo exactly as it is. Record, in a separate dated note, what the first review did not cover. Carry out the current review so that it assesses implementation as well as adequacy, using methods that fit the firm’s business and risks. Document the work and its results, and keep them with the original memo. Each corrective step has an owner and a date.
Through their eyes
What you say you do, what you actually do and what you can prove have to tell the same story.
A policy can look excellent on paper and still fail under examination. We follow the evidence: policies, procedures, governance, controls, testing, records and actual business practice, looking for inconsistencies, weak evidence and places where the written program does not match what happens.
What you say you do
Policies, procedures and the commitments made to the regulator in applications and correspondence.
What you actually do
How the business runs day to day, and where practice has drifted from the document.
What you can prove
Testing results, records, minutes, logs and approvals. If it cannot be shown, an examiner treats it as not done.
The examination
Once the review is complete, we stop advising and start examining.
Your team receives a realistic document request. Responses are reviewed, evidence is challenged, interviews are conducted and controls are tested. Follow-up questions come from the answers we receive, as they would on the day. We do not hand out the questions in advance. The real regulator will not either. The point is to see how the program and the people perform under pressure while there is still time to do something about it.
The people
The regulator is not interviewing your compliance manual. It is interviewing your people.
A good program can have a bad examination. We prepare everyone who may face the regulator: compliance leadership, senior management, operations, the front office and board members where relevant. Preparation is individual, because people respond differently under pressure. We do not give people scripts. We make sure they understand the program well enough to speak for themselves. Confidence matters. Credibility matters more.
Answer the question that was asked
Not the one you prepared for.
Explain a control clearly
What it does, who runs it, how you know it worked.
Support the answer with evidence
Know what exists and where it is.
Handle what you do not know
How to say so, and how to come back with the answer.
Stay composed when the examiner keeps pushing
Pressure is part of the method. Preparation is the answer to it.
Your side of the table
The regulator controls the examination. You should still control your side of it.
An examination becomes difficult very quickly when nobody is clearly managing it. We set the structure before the regulator arrives, and we prepare management for the hard moments: difficult conversations, emerging findings, the exit meeting and the remediation discussion that follows.
Who leads
One person runs the process and one voice speaks to the regulator.
How requests are handled
Every document request logged, every response reviewed before it goes out, every piece of evidence controlled.
When to escalate
What counts as an issue, who hears about it and how fast.
Who sits in interviews
And how the team handles the follow-up questions afterwards.
The examiner is changing too
Prepare for the examination happening now, not the one someone remembers from five years ago.
Regulators have more data and stronger analytics than they used to, and the use of artificial intelligence inside financial institutions has become an examination topic in its own right. We follow regulatory priorities, findings, enforcement, speeches and changes in supervisory technology continuously, so your preparation reflects how examinations are run today.
Different name, same pressure
Examination, inspection, supervisory review, thematic review.
Regulators use different words around the world. Whatever it is called, someone is coming to look under the hood. ExamReady is built for investment advisers, funds, broker-dealers, banks, fintechs, payments firms, digital-asset businesses and other regulated financial institutions, in the United States and internationally. It is led by former regulators, chief compliance officers and senior practitioners who have built programs, run them, defended them and managed the remediation that followed.
Preparation or Live
Before the examination, or once it has begun.
ExamReady prepares a firm before an examination. ExamReady Live stays with the team from the first document request to the last finding.
Before
Regulatory intelligence, a program review, a mock examination, priority remediation, interview preparation and an examination strategy.
During (ExamReady Live)
Document request management, response review before it goes out, interview preparation person by person, daily examination debriefs, emerging issue analysis, regulatory correspondence and management support.
After (ExamReady Live)
Exit meeting preparation, findings analysis, the regulatory response, remediation planning, follow-up support and closure.
How it runs
How it runs.
Know
We study your regulator, the requirements that apply to you, its current priorities, what your peers are being asked, and its recent activity.
Review
We examine your program and the evidence behind it, and we look early at whether policies, controls and practice match, so there is time to address what does not.
Simulate
Your team goes through a realistic examination or inspection: document requests, interviews, testing, challenge and follow-up.
Prepare
We work individually with each person who may face the regulator, on their responsibilities, their evidence and where they are likely to be challenged.
Fix
Findings are prioritized. Immediate fixes are separated from issues that need structured remediation, each with an owner and a date.
Hand over
Your regulatory intelligence, examination strategy, response process and people come together before the real examination begins. If you want us there for it, ExamReady Live continues from the first request to closure.
Questions
Asked before, answered plainly.
- What does “Know Your Regulator” mean?
- That readiness starts with knowing who is examining you and what they expect of a firm like yours: their priorities, their questions, what they are finding elsewhere, how they grade what they find. ExamReady briefs your team on exactly that, then rehearses it.
- Who runs the mock exam and the training?
- Practitioners who have been examined and who have examined: former compliance officers and former regulators, matched to your regime.
- Do you stay for the real examination?
- If you want us to. ExamReady Live covers the examination itself: document request management, response review, interview preparation, daily debriefs, regulatory correspondence, and the exit meeting, findings and remediation afterwards.
- Does the training replace the mock exam?
- No. The mock exam shows where the program and the people stand; the training fixes what the interviews revealed. They are one product because each is weaker without the other.
- Can anyone guarantee a clean examination?
- No, and anyone who promises one should probably appear in your risk assessment. What we can do is look for weaknesses before the examination, prepare your people for difficult questions, and give you written findings with an owner for each.
- What does ExamReady provide?
- A review of your program, a mock examination, and preparation of the people who may face the examiner. ExamReady Live adds support during the examination itself.
- We registered with the SEC a year ago. Is a first examination still ahead of us?
- It may be. The SEC’s examination staff has said that for several years it has prioritized examining newly registered advisers within a reasonable period of time after registration becomes effective. That statement sets no date. Source: https://www.sec.gov/files/risk-alert-newly-registered-ias-032723.pdf
- What if the regulator has already made contact?
- ExamReady Live covers the examination itself: document request management, response review before it goes out, interview preparation person by person, daily debriefs, and the exit meeting, findings analysis and regulatory response afterwards.
ExamReady is an independent assessment and training program by compliance practitioners. It is not a regulatory examination, not legal advice, and no outcome with a regulator can be guaranteed.