The 5 BCP Mistakes That Trigger SEC Deficiency Letters

SEC examination deficiency letters are costly, time-consuming, and deeply stressful for any RIA. What makes them especially frustrating is that the majority of BCP-related findings are entirely predictable — and entirely fixable. Compliance professionals who work across many RIA examinations consistently point to the same handful of recurring mistakes. If you can eliminate these five, you've eliminated a large share of your BCP examination risk.

Mistake #1: The "Set It and Forget It" BCP

The most common BCP mistake at smaller RIAs isn't a technical compliance failure — it's a process failure. Firms build a BCP (often at substantial cost), file it somewhere on their server, and then don't touch it for 18, 24, sometimes 36 months. When an examiner reviews it, the disconnect between the plan and the firm's current reality is immediately apparent.

Examiners aren't just reading your BCP — they're comparing it to your current Form ADV, your current staff roster, your current vendor agreements, and the answers you're giving in your examination interview. When the plan says your operations manager is "Jennifer Wu" and your current operations manager is "David Patel," that's a finding. When the plan references a custodian you switched away from two years ago, that's a finding.

What triggers this finding: No documented annual review, contact information that doesn't match current personnel, references to discontinued vendors or technologies, outdated office locations or remote work policies.

The Fix
Establish a formal BCP calendar with two types of reviews: (1) an annual comprehensive review, and (2) trigger-based reviews whenever material changes occur — staff changes, vendor changes, technology migrations, regulatory updates. Document every review with date, reviewer, and a change log. If nothing changed, document that too.

Mistake #2: Vague Succession Planning That Names No One

SEC examiners have grown increasingly specific in their succession planning expectations, and the language many firms use in their BCPs — "a qualified replacement will be identified" or "succession will be handled by senior management" — is no longer adequate.

Examiners want to see named individuals. They want to see confirmation that those individuals are aware of their contingency roles. They want to understand how client portfolios will be managed, how client relationships will be maintained, and how client assets will be protected in the specific scenarios of key-person incapacitation, departure, or death.

For smaller RIAs — particularly sole practitioners or two-person firms — this is the single most important and most commonly deficient element of BCP planning. If you are the firm's sole investment decision-maker and your BCP doesn't credibly answer "what happens to client portfolios if you can't work for 90 days," you have a material deficiency.

The Fix
Name your successors. Have documented conversations with them confirming their willingness and ability to serve. For sole practitioners without internal succession candidates, consider a written arrangement with another RIA to serve as backup — and document that arrangement in your BCP. Be specific about the division of client relationships and investment decision-making authority.

Mistake #3: Technology Continuity Treated as an IT Issue, Not a Compliance Issue

Most RIA BCPs were written before cybersecurity became a dominant concern — and it shows. Plans that treat technology continuity as "contact your IT vendor" are systematically inadequate by current standards, particularly post the SEC's cybersecurity disclosure rules and the Division of Examinations' increased focus on operational resilience.

Examiners want specific answers to specific questions: If your primary CRM is unavailable for 72 hours, can you access client data? If your email system is compromised, how will you communicate with clients? If your portfolio management system is offline during a market crisis, how will you execute trades? Do you have offline backup records sufficient to reconstruct client positions?

Firms that answer these questions with "we'll call our IT vendor" are receiving deficiency comments with increasing frequency.

The Fix
Work with your technology vendors to document specific recovery time objectives (RTOs) and recovery point objectives (RPOs) for each critical system. Add these to your BCP. Document your offline backup procedures and test them at least annually. Ensure your BCP cross-references your cybersecurity incident response plan, and that both documents are current and consistent.

Mistake #4: Missing or Generic Client Communication Protocols

An RIA's fiduciary obligation to clients doesn't pause during a disruption — it intensifies. Clients whose adviser is experiencing a crisis need to know what's happening, what it means for their accounts, and what the firm is doing about it. BCPs that don't address client communication in specific, operational terms are missing a core element of what regulators now expect.

The deficiency most commonly found in this area: BCPs that simply state "clients will be notified" without specifying how, within what timeframe, through what channels, with what content, or by whom. In 2026, "clients will be notified" is not a plan — it is a vague aspiration.

Regulators are particularly focused on this area in the context of cybersecurity incidents, where the interplay between your BCP client notification procedures and your SEC cybersecurity disclosure obligations creates a complex and consequential set of requirements.

The Fix
Build specific client notification procedures into your BCP for each major scenario type. Include: notification timeline (e.g., "within 24 hours of a material disruption"), communication channels (email, phone, client portal), message templates (pre-drafted and pre-approved), responsible party (named individual), and escalation procedures if that individual is unavailable.

Mistake #5: Never Having Tested the Plan — At All

This is the fastest-growing category of BCP examination findings, and it reflects a fundamental shift in regulatory expectations. For years, having a BCP was sufficient. Increasingly, having a tested BCP is what separates passing examinations from deficiency letters.

Testing doesn't require a full-scale operational exercise. A tabletop exercise — a structured conversation where key staff walk through a hypothetical disruption scenario and discuss their responses — takes 60 to 90 minutes and generates valuable documentation. What matters is that you do it, that you document it, and that you capture any findings and address them.

Firms that have never tested their BCPs are often surprised to discover, during a tabletop exercise, that their plan contains significant gaps they never noticed — because they never had to think through the plan in operational terms. Discovering those gaps in a tabletop exercise is vastly preferable to discovering them during an actual disruption, or during an examination.

The Fix
Schedule your first tabletop exercise before the end of this quarter. Choose a scenario realistic to your firm — a ransomware attack, the sudden illness of your principal, or a multi-day office closure. Invite 3 to 5 participants. Use a structured facilitator guide (Plan & Recover can generate one for your specific firm). Document the exercise, findings, and follow-up actions. Repeat annually.