A risk alert issued on November 7, 2019, by the SEC’s Office of Compliance Inspections and Examinations underscores a continuing dilemma faced by SEC-regulated entities.

The risk alert undertakes to summarize the “most often cited deficiencies and weaknesses that the staff has observed in recent examinations of registered investment companies.” Many of the summarized deficiencies involve failures to adhere to the various types of compliance policies and procedures that the registrants have adopted — even in cases in which the failure did not result in whatever type of legal violation the procedures might have been designed to prevent.

OCIE’s tendency to cite failure to adhere to compliance policies and procedures as a discrete compliance deficiency naturally incentivizes registrants to limit the scope and detail of their compliance policies and procedures as much as possible, consistent with being reasonably designed to prevent violations of relevant legal requirements.

However, attempts to pare back on any arguably superfluous compliance policy and procedure provisions also risk incurring OCIE’s ire. Indeed, the preponderance of the risk alert summarizes numerous areas in which the staff seems ready to second-guess registrant judgments that more detail is unnecessary in compliance policies and procedures, even if no other legal violation has resulted.

It can be appropriate for some compliance policies and procedures to be quite general in nature — e.g., simply assigning to a particular person responsibility for compliance with a given legal requirement, perhaps specifying some key principles for that person to follow. To ensure compliance with other legal requirements, however, it may be necessary or advisable to adopt a more prescriptive approach that specifies in some detail what steps the responsible personnel are to take.

The process of crafting compliance policies and procedures, therefore, necessarily involves difficult judgment calls, and the Risk Alert makes clear that registrants will not be immune from OCIE criticism after the fact, regardless of what approach they take. This doubtless also applies to registered broker-dealers and investment advisers, although the risk alert by its terms only covers mutual funds, insurance company separate accounts, and other registered investment companies.